Do ASP.NET forms authentication cookies provide any protection against replay at

Do ASP.NET forms authentication cookies provide any protection against replay attacks? Do they, for example, include the client's IP address or anything else that would distinguish the real client from an attacker?

Question Posted / surendra singh

1 Answers
1702 Views
I also Faced
E-Mail Answers

Do ASP.NET forms authentication cookies provide any protection against replay attacks? Do they, for ..

Answer / surendra singh

No. If an authentication cookie is stolen, it can be used by an attacker. It's up to you to prevent this from happening by using an encrypted communications channel (HTTPS). Authentication cookies issued as session cookies, do, however,include a time-out valid that limits their lifetime. So a stolen session cookie can only be used in replay attacks as long as the ticket inside the cookie is valid. The default time-out interval is 30 minutes.You can change that by modifying the timeout attribute accompanying the <forms> element in Machine.config or a local Web.config file. Persistent authentication cookies do not time-out and therefore are a more serious security threat if stolen.

Is This Answer Correct ?

0 Yes

0 No

Post New Answer

More ASP.NET Interview Questions

Where is http session stored?

0 Answers

what is webservices. howit is use in our project .

4 Answers TCS,

List some of the important session state modes of asp.net.

0 Answers

Explain the difference between asp.net mvc and asp.net webforms? : asp.net mvc