StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
primarykey
Id
781766
data
AcceptedAnswerId
782763
AnswerCount
1
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2009-04-23T13:40:28.923
FavoriteCount
4
LastActivityDate
2009-08-18T09:43:18.990
LastEditDate
2009-08-18T09:43:18.990
LastEditorUserId
6651
OwnerUserId
12124
ParentId
0
PostTypeId
1
Score
6
ViewCount
3809
LastEditorDisplayName
text
Body
We've noticed that it's possible to recreate a copy of an ASP.NET FormsAuthentication cookie on another machine, allowing the second machine to authenticate without needing to log in. One suggested solution to this has been to store the session ID within <code>FormsAuthenticationTicket.UserData</code> and to check that the two values match inside <code>Application_AuthenticateRequest()</code>. We're using: <pre><code>FormsAuthenticationTicket.IsPersistent = false; </code></pre> Is this approach of associating FormsAuthentication cookie with the session ID a good idea?
Tags
<asp.net><security><cookies><forms-authentication>
Title
Can I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USAlex Angas
UserOwnerUserId
1. UStjrobinson
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
 UserUserId
 UStjrobinson
 VoteTypeVoteTypeId
 VTFavorite
2. VO
 singulars
 PostPostId
 POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
 UserUserId
 USAlexMinza
 VoteTypeVoteTypeId
 VTFavorite
CommentsPostId
1. COIs this something you've actually tried? You have actually had another machine log in using a cookie from another machine? I thought there was some per-session encryption.
 singulars
 PostPostId
 POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
 UserUserId
 USJohn Saunders
2. COA colleague has tried it. I don't know if any encryption has been configured.
 singulars
 PostPostId
 POCan I make my ASP.NET FormsAuthentication cookie more secure by associating it with the session ID?
 UserUserId
 UStjrobinson

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.