FormsAuthentication.FormsCookiePath

Question

Hello,

Q1 I’ve read that when setting the timeout of an authentication cookie, we should keep in mind that the longer the cookie persists, the greater the chance of a cookie being stolen and misused.

A) But assuming we secure our application against replay attacks by enabling SSL for the entire application, and since forms authentication module also encrypts authentication data in authentication cookie, then I would think there is no chance of this cookie being misused and thus cookies being persisted for longer periods of time should not present any security risks?!

Q2

FormsAuthentication.FormsCookiePath specifies where authentication cookie is stored. Default value is ‘/’.

A) Assuming default value ’/’ is used, where is cookie saved then?

B) Is this option only used for persistent cookies?

thanx

Answer 1

2A The cookie path is the path on the server the cookie relates to, not the path where the cookie is store.

From http://www.quirksmode.org/js/cookies.html

The path gives you the chance to specify a directory where the cookie is active. So if you want the cookie to be only sent to pages in the directory cgi-bin, set the path to /cgi-bin. Usually the path is set to /, which means the cookie is valid throughout the entire domain. This script does so, so the cookies you can set on this page will be sent to any page in the www.quirksmode.org domain (though only this page has a script that searches for the cookies and does something with them).

You are using ASP.Net. Also see the "CookieLess" Session and Authenication options e.g. http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.formscookiepath.aspx If you are worried about cookies. This uses a URL session ID instead to track your session.

You can also use a SQL Server to track session state or a State server. e.g.

<sessionState mode="SQLServer" sqlConnectionString="SQLSessionDB" cookieless="false" timeout="65" cookieName="MSESSID"/>

1A. SSL encrypts transport. Hence your cookies will be less likely to be stolen on route to the client or back. That doesn't mean a malicious program on the client computer can't steal it. This is very unlikely though.