4

We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.

Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's developer tools, there are some cookies with Secure flag. But ASPXAUTH was not one of them.

enter image description here

Already I have included below line of code in Web.Config file.

<httpCookies requireSSL="true"/>

Note : We are not using Forms Authentication for login.

What is the correct way to mark ASPXAUTH as secure?

  • If you are not using forms authentication why are you using this cookie? – ste-fu Oct 13 '17 at 11:50
1

I'm going to hazard a guess and say that this flag in your config is being ignored:

Looking at the httpCookies docs it says that "This setting is overridden by any other feature that exposes the requireSSL configuration"

One way to ensure that it is set would be to do it in dedicated code.

This Stack Overflow answer has an example

Basically before the response is complete in protected void Application_EndRequest(Object sender, EventArgs e) in Global.asax you check for the correct cookie and set the .Secure property to true

  • I tried this link but it is not working. How to Manually set secure flag for .aspxauth cookie? Could you please share me a link. – Ask_SO Oct 13 '17 at 14:58
  • You hit the nail on the head. Specifically, the forms node of the authentication element implements and exposes the requireSSL configuration option. The OP needs to set requireSSL="true" in that node in the web.config as well. – Xander Jan 1 at 16:19
0

Check it from the MSDN

To prevent forms authentication cookies from being captured and tampered with while crossing the network, ensure that you use SSL with all pages that require authenticated access and restrict forms authentication tickets to SSL channels by setting requireSSL="true" on the element.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.