Question

I have a website, its completely over HTTPS. Even if someone tries to access over HTTP he will be redirected to HTTPS. I am using forms authentication. Recently I changed a setting to make the site more secure and after that Session is not retaining values and is always returning null. The settings are,

<httpCookies httpOnlyCookies="true" requireSSL="true"/>
<sessionState cookieless="false"/>

I have no idea on how to fix this issue. How do I fix this issue? Also, is my site vulnerable if I do not use this setting? consider that everything else is secure.

Answer 1

You question is too general with out many clues, so I can give you some points to move on.

[1] set also the domain on the cookies, with out the www., so the cookie can be read and set even if by mistake the www is missing.

<httpCookies domain="yourdomain.com" httpOnlyCookies="true" requireSSL="true"/>

[2] you also need to setup the <forms... with similar parameters (and what ever else you have set)

<forms name=".klidi" path="/" requireSSL="true" cookieless="UseCookies" 
   domain="yourdomain.com" enableCrossAppRedirects="false" 
        slidingExpiration="true" />

[3] you also need to setup the <roleManager with similar parameters.

<roleManager enabled="true" cacheRolesInCookie="false" cookieProtection="All" cookieSlidingExpiration="true" 
           cookieTimeout="20" domain="yourdomain.com" cookieRequireSSL="true">

and last the most important set this line on your code before you try to set or use any cookie to see if by mistake you did not use secure connection https.

Debug.Assert(HttpContext.Current.Request.IsSecureConnection, "With out https, cookie will not work");

By setting the last line, on your computer when you make your site you can see and diagnose if the problem is coming from non secure connection, because from the moment you set the requireSSL to true, any simple connection will not hold any cookie.

Also try to clear your cookies in the case that the cookie exist as non secure and you have any conflict, and or try other browsers.

You can also read: Can some hacker steal the cookie from a user and login with that name on a web site?