I am developing a sensitive web application with .net MVC and I am saving my user credentials after login with cookies.

The problem is, one user is able to login with their username and password. Then he/she is able to edit the cookies and reset cookies to another user id. It's causing a security issue. How can we prevent that?

  • Why are you saving user credentials in a cookie? – Neil McGuigan Mar 22 '17 at 18:19

Use a cryptographically safe cookie value such that modification of the value would invalidate the session. In other words

cookie = encrypt(username, expiration, secret)

Where only your application knows the secret. With that said, don't do this yourself. There are a ton of ways this can be done securely in MVC.


The issue here is the following:

User A logs on. You create a cookie value to represent that login of user A and send this cookie value to user A's browser where it will be stored.

Whoever knows the value of that cookie can claim to be user A. This is not a bug, but a feature, because the purpose of having the cookie is that the user can identify he his himself by having the browser send the cookie to the server along with all the requests.

What you need to make sure is that no other person has a chance to read the cookie value. There are several things you should do to reduce the chance of other persons getting hold of user A's cookie value:

  1. Only allow your site to be used via https. Redirect to the https version when a user tries to access the http version of a page. This prevents attackers from reading the cookie value on the wire during transfer.
  2. Set the HTTPONLY and SECURE attributes of the cookie. HTTPONLY prevents javascript code from reading the cookie value. SECURE prevents the browser from sending the cookie when the user tries to access the http version of a page. You can enable these attributes in ASP.net by setting the httpOnlyCookies and requireSSL attributes in the web.config file.
  3. Tell the browser to delete the cookie when a the user logs off manually. If you are using Forms Authentication, FormsAuthentication.SignOut() will do that already.
  4. If you have a site with very sensible data, use javascript to implement an automatic logoff after a certain time of user inactivity, also telling the browser to delete the cookie.
  5. Use a cookie with no expires attribute, so that the cookie is not stored on disk by the browser and is automatically deleted by the browser when the browser session ends.
  6. Educate your users to manually logoff from your site before leaving the site, when they are on a computer that is not their own. (In fact, educate your users to not log on to your site from computers they do not trust.)

It is not clear from your question how you generate the cookie value. As Steve has written, the cookie content should be encrypted in a way that the user cannot modify the cookie value, exchanging the user id and still having a valid cookie content. If you are using Forms Authentication in asp.net, this automatically happens, the cookie is encrypted with a machine key stored on your server (for example in IIS).

If you have multiple applications running on the same server, make sure that each application uses its own set of machine keys, so that an attacker cannot use the cookie generated by one application to logon in another application on the same server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.