Blog

Filter posts by Category Or Tag of the Blog section!

Cookie stealing in asp.net

Monday, 28 September 2015

You know that the cookie could be stolen by attackers. As nothing is secure until it's designed to be so, to make your cookie safe, firstly use HTTPS and make it required in your Web.config :

 

<httpCookies httpOnlyCookies="true" requireSSL="true" />

 

Personally, I don't store important data in the cookie and I just store a key in the cookie and by using that key I fetch the target data from a database but it doesn't work everywhere and it's not a solution for all the problems at all! Anyway, if you can't use Https, You can config the SSL by code for some sensitive cookies like below:

 

 protected void ForceCookieToBeHttpOnly(string cookieName, string cookieValue)

        {

            HttpCookie myHttpCookie = new HttpCookie(cookieName, cookieValue);

            Response.Cookies.Add(myHttpCookie);

            myHttpCookie.HttpOnly = true;

        }

 

But remember that, the only effective solution is Https.

Category: Software

Tags: Asp.Net

comments powered by Disqus