Jim's Blog Ramblings about novels, comics, programming, and other geek topics

Securing ASP.NET Web Sites: Cookie Vulnerabilities

This is the first of my series on securing ASP.NET web sites. As I work through various vulnerabilities, I’ll document instructions for fellow web developers in hopes that we can help build more secure web applications. The Cookie Vulnerability falls under the common vulnerability name of "Broken Authentication and Session Management."

What is "Broken Authentication and Session Management"?

This cookie vulnerability is OWASP 2010 A3. You can read more at Top 10 2010-A3-Broken Authentication and Session Management. This threat applies to application functions related to authentication and session management not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users’ identities.

Securing ASP.NET Cookies

When a cookie is not set securely, then it is sent by the browser with both unencrypted and encrypted requests – even if you are using a SSL encryption. If an attacker can intercept the cookie, then they can steal the cookie and information contained within.

To fix this for ASP.NET web sites, your web application must be using HTTPS. Second, you must update your web.config and add in the below configuration change.

<system.web>
   <httpCookies httpOnlyCookies=”false” requireSSL=”true” />
</system.web>

To prevent against cross-site scripting, you can set the "httpOnlyCookies" to true. That setting will prevent any JavaScript (or VBScript) from accessing the cookie and only allow server-side code to access the cookie.

Also note that the "forms" web.config element will override this value, if "requireSSL" XML attribute's value is "true."

Reference

• OWASP Top 10 - A3 (OWASP.org)
• httpCookies Element (ASP.NET) (MSDN)

James Welch

James Welch is a software engineer in Vermont working for a large information technology company and specializing in .NET. Additionally, he holds a Master’s Degree in Software Engineering and a Bachelor of Science Degree in Computer Science. Jim also enjoys local craft beer, comic books, and science-fiction and fantasy novels, games, and movies.