Home/ Questions/Q 351323
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T11:37:59+00:00

I have an ASP.NET 3.5 Web Site using the standard SQL Membership Provider. The

  • 0

I have an ASP.NET 3.5 Web Site using the standard SQL Membership Provider.

The application has to pass the IBM Rational AppScan before we can push to production.

I am getting the error:
Severity: High
Test Type: Application
Vulnerable URL: http://mytestserver/myapp/login.aspx
Remediation Tasks: Do not accept externally created session identifiers

What can I do to fix this?

I am using SQL Membership Provider. Is this related? I am using the standard login controls too. I have the “Remember Me” turned off, and hidden.

Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This isn’t a vulnerability (and I really don’t like AppScan because of its false positives – the number of times I’ve had to explain CSRF cookies need not be linked to a session on my little open source project is getting annoying).

    All that will happen in this case is the first time anything is stored in session state with a created session identifier a new session will be opened on the server, with nothing in it. If you’re worried about session fixation then you can clear the cookie after authentication.

    Session.Abandon();
Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));

    But with forms authentication the authentication details are not held in the session and so fixation is not a problem at all.

    Frankly if you must pass security scans without anyone evaluating if the results are not false positives then that’s a whole different problem.

    • 0