Home/ Questions/Q 8146625
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T14:04:02+00:00

In asp.net, I am able to login using forms authentication as usual, copy our

  • 0

In asp.net, I am able to login using forms authentication as usual, copy our auth cookie value, log out, add the cookie artificially to the client using the ‘Edit This Cookie’ addon for Chrome, refresh the (anonymous) landing page and hey presto i’m logged in again. This seems to be a vulnerability – is there any way of fixing it using the the standard forms auth or will I have to do something like use a custom Authorize attribute which overrides the existing one in asp.net mvc?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Cookies are always vulerable and we can’t do much about that. What we can do is prevent someone from stealing the cookies.

    Regarding ASP.NET MVC it does a good job to avoid stealing cookies. Some of the main things it does by default as part of security are:

    1. Encode the strings that are rendered to the view (if you are using Razor don’t know about others) to prevent from XSS attacks.

    2. Request validation (stop potentially dangerous data ever reaching the
      application).

    3. Preventing GET access for JSON data.

    4. Preventing CSRF Using the Antiforgery Helpers

    Regarding cookies Microsoft provides HttpOnly feature and this helps to hide the cookies from javascript. The Forms authentication that you are talking about is a HttpOnly cookie means someone can’t steal that through JavaScript and it’s more safe.

    • 0