Cookie & Https

Question

I'm trying to write a cookie in ASP.NET under https, but I see a plain text cookie in the client machine. Shouldn't the cookie be encrypted by default under an https connection?

Answer 1

Your cookie will only be encrypted during transmission of the cookie to/from your browser. If you want the cookie to be encrypted in the browser's cookie store, you'd need to encrypt it on the server first and then decrypt on the server upon use in server side scripts.

SSL/TLS is just a transport security mechanism to encrypt requests/responses on the wire, it is up to the browser to provide a mechanism to store cookies securely on the client (or as mentioned above, your application can do this).

Answer 2

It should be encrypted on the wire then decrypted by your browser.

Answer 3

Short answer is no, cookies are not encrypted in ASP.NET under SSL. SSL is a transport-level protocol, encrypting only the communications between the client and server. Cookies and query-string values are NOT encrypted by SSL. Once the cookie is on the client machine, it is left in whatever format it left the server in.

Answer 4

Nope, AFAIK only the transfer is encrypted, the cookie on the client side isn't. You should encrypt it yourself for better security.

Answer 5

This might help you encrypt the cookie. http://www.15seconds.com/Issue/021210.htm

Example uses Triple DES though, that may or may not be the best algorithm depending on your perspective.