Question

My understanding is that ASP generates a cookie to authenticate a session. However, if that cookie is sent back and forth over a non https channel, can’t I spoof it simply by spoofing the cookie? Can the cookie be locked to a particular IP or other machine fingerprint?

Answer 1

Sessions in ASP.NET aren’t authenticated – authentication is entirely separate. By taking a session cookie and recreating it yes you can hijack the session, and if you lift an authentication cookie then you can authenticate as a user (which is why, by default, authentication cookies expire) – see http://msdn.microsoft.com/en-us/library/ms178581.aspx

The security note is quite clear;

SessionID values are sent in clear text, whether as a cookie or as
part of the URL. A malicious user could get access to the session of
another user by obtaining the SessionID value and including it in
requests to the server. If you are storing sensitive information in
session state, it is recommended that you use SSL to encrypt any
communication between the browser and server that includes the
SessionID value.