The issue here is the following:
User A logs on. You create a cookie value to represent that login of user A and send this cookie value to user A's browser where it will be stored.
Whoever knows the value of that cookie can claim to be user A. This is not a bug, but a feature, because the purpose of having the cookie is that the user can identify he his himself by having the browser send the cookie to the server along with all the requests.
What you need to make sure is that no other person has a chance to read the cookie value. There are several things you should do to reduce the chance of other persons getting hold of user A's cookie value:
- Only allow your site to be used via https. Redirect to the https version when a user tries to access the http version of a page. This prevents attackers from reading the cookie value on the wire during transfer.
- Set the
SECURE attributes of the cookie.
SECURE prevents the browser from sending the cookie when the user tries to access the http version of a page. You can enable these attributes in ASP.net by setting the
requireSSL attributes in the
- Tell the browser to delete the cookie when a the user logs off manually. If you are using Forms Authentication,
FormsAuthentication.SignOut() will do that already.
- Use a cookie with no
expires attribute, so that the cookie is not stored on disk by the browser and is automatically deleted by the browser when the browser session ends.
- Educate your users to manually logoff from your site before leaving the site, when they are on a computer that is not their own. (In fact, educate your users to not log on to your site from computers they do not trust.)
It is not clear from your question how you generate the cookie value. As Steve has written, the cookie content should be encrypted in a way that the user cannot modify the cookie value, exchanging the user id and still having a valid cookie content. If you are using Forms Authentication in asp.net, this automatically happens, the cookie is encrypted with a machine key stored on your server (for example in IIS).
If you have multiple applications running on the same server, make sure that each application uses its own set of machine keys, so that an attacker cannot use the cookie generated by one application to logon in another application on the same server.