Improving Web Application Security: Threats and - CGISecurity

280 Part III: Building Secure Web ApplicationsSecure the Authentication CookieTo prevent session hijacking and cookie replay attacks, secure the cookie by makingsure that it is only passed over SSL connections using the HTTPS protocol. Foradditional risk mitigation, encrypt the cookie before sending it to the client and limitthe period for which the cookie is valid. To secure the authentication cookie:●●●●●●●Restrict the authentication cookie to HTTPS connections.Encrypt the cookie.Limit cookie lifetime.Consider using a fixed expiration period.Do not persist authentication cookies.Keep authentication and personalization cookies separate.Use distinct cookie names and paths.Restrict the Authentication Cookie-to-HTTPS ConnectionsCookies support a “secure” property that determines whether or not browsers shouldsend the cookie back to the server. With the secure property set, the cookie is sent bythe browser only to a secure page that is requested using an HTTPS URL.If you are using .NET Framework version 1.1, set the secure property by usingrequireSSL=“true” on the element as follows:If you are using .NET Framework version 1.0, set the secure property manually in theApplication_EndRequest event handler in Global.asax using the following code:protected void Application_EndRequest(Object sender, EventArgs e){string authCookie = FormsAuthentication.FormsCookieName;}foreach (string sCookie in Response.Cookies){if (sCookie.Equals(authCookie)){// Set the cookie to be secure. Browsers will send the cookie// only to pages requested with httpsResponse.Cookies[sCookie].Secure = true;}}