ASP.Net identifies users by means of session ID Cookie [ASP.Net_SessionID]. In case of form authentication it uses additional cookie called .ASPXAUTH.
If an attacker get these cookies then they can impersonate as valid user. Eventhough modern browser restrit to alter these cookies if you access it from differnt site but if the attackers is able to inject the script in our page then they will gain the access to these cookies.
This attack can be prevented be these methods
Client IP Address Check:
If an attacker get these cookies then they can impersonate as valid user. Eventhough modern browser restrit to alter these cookies if you access it from differnt site but if the attackers is able to inject the script in our page then they will gain the access to these cookies.
This attack can be prevented be these methods
Client IP Address Check:
Track the client IP address on which the session has been initiated. Deny if the request if the client IP address is different from the initiated IP address.
Even though this is nice solution but it suite for corporate LAN scenario but not suitable for Internet application. It will reject the client request in these scenarios
* Connection has been reset and client go new IP Address.
* ISP provider process all the HTTP through different set of load balance proxy server.
HTTPOnly Cookie:
Even though this is nice solution but it suite for corporate LAN scenario but not suitable for Internet application. It will reject the client request in these scenarios
* Connection has been reset and client go new IP Address.
* ISP provider process all the HTTP through different set of load balance proxy server.
HTTPOnly Cookie:
Mark a Cookie with HTTPOnly flag. This will hide the existance of the cookie to JavaScript but it will pass it with HTTP requests. Mark all the sensitive cookies as HTTPOnly ntill or unless you have a specific reason to access it through Javascript.
By default ASP.Net marks both ASP.Net_SessionID and .ASPXAUTH cookies as HTTPReadonly. You can set it HTTPOnly as mentioned below
Response.Cookies.Add(new HttpCookie("Cookie1")
{
Value = "Values",
HttpOnly = true
});
It’s not a complete defense against cookie stealing, because you might still inadvertently expose the cookie contents elsewhere.
By default ASP.Net marks both ASP.Net_SessionID and .ASPXAUTH cookies as HTTPReadonly. You can set it HTTPOnly as mentioned below
Response.Cookies.Add(new HttpCookie("Cookie1")
{
Value = "Values",
HttpOnly = true
});
It’s not a complete defense against cookie stealing, because you might still inadvertently expose the cookie contents elsewhere.
References
1. Pro ASP.Net MVC 3 Framework by Adam Freeman & Steven Sanderson
2. https://www.owasp.org/index.php/Session_hijacking_attack
