Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 281Encrypt the CookieEncrypt the cookie contents even if you are using SSL. This prevents an attacker fromviewing or modifying the cookie if he or she manages to steal it through a XSSexploit. In this event, the attacker can still use the cookie to gain access to yourapplication. The best way to mitigate this risk is to implement the appropriatecountermeasures to prevent XSS attacks (described under “Cross-Site Scripting”earlier in this chapter), and limit the cookie lifetime as described in the nextrecommendation.To provide privacy and integrity for the cookie, set the protection attribute on the element as follows: