views:

688

answers:

1

We've noticed that it's possible to recreate a copy of an ASP.NET FormsAuthentication cookie on another machine, allowing the second machine to authenticate without needing to log in.

One suggested solution to this has been to store the session ID within FormsAuthenticationTicket.UserData and to check that the two values match inside Application_AuthenticateRequest().

We're using:

FormsAuthenticationTicket.IsPersistent = false;

Is this approach of associating FormsAuthentication cookie with the session ID a good idea?

+3  A: 

I think that you are overthinking the problem. The ability to copy a cookie is just an inherent problem of cookies - anyone can intercept any cookie and impersonate whatever data is in there by setting it up on another machine.

The "security" of the authentication cookie comes from the fact that no one can (supposedly) craft the cookie by hand to fake an authenticated user. However, once the cookie is created, of course it can be used for authentication. This means that in order for your "problem" to happen, you still need to have a valid user log in first. If that user is abusing the system by copying his cookie to other machines to give everyone access, it's exactly the same thing as the user just telling everyone her username and password, except far more obtuse. Therefore, the problem isn't the copying of the cookie - it's the user herself.

Another attack vector would be if the network is compromised and someone can intercept the traffic to piece together the cookie via a sniffer or whatever - but again, this is inherent with cookies themselves. This is called Session Hijacking, and the only way to protect against this is to use SSL for your site.

If you're really worried about it, I'd just set your authentication and session timeouts to be the same, and then in your global.asax file, simply call FormsAuthentication.Signout() whenever the user's session expires. This invalidates the authentication whenever the user is done their session, forcing them to log in again later. Of course, this might be an extreme annoyance to your users...

I would also highly recommend This MSDN article. It probably answers your questions a lot better than I can.

womp
Thanks for your answer - it's actually along the lines of what I was thinking but wanted a second opinion before I tried to fix something that wasn't actually a problem.Your suggested FormsAuthentication.Signout() doesn't seem applicable in my case as the authentication cookie expires at the end of the session anyway - forcing users to log in each new session. Or have I missed something?
tjrobinson
What about the case where a users machine becomes infected with a virus that steals their cookie? SSL wouldn't protect them then. I suppose it's just a variation of Session Hijacking though in that case.
tjrobinson
Re: first comment. I don't think you've missed anything. I did think about it some more last night and thought that you could try setting some user data into the authentication ticket, like their IP address or something, and if that information changed, automatically log them out. That makes it harder for another machine to impersonate... but IP address can also be spoofed. It would be a tiny bit more secure though.Re: second comment - yep, just another variation.
womp