Patterns And Practices Security Checklists

[A.M]

Hi,

In Architecture and Design Review Security Checklist at following link:

[url]http://msdn.microsoft.com/library/en-us/dnnetsec/html/CL_ArchDes.asp?frame=true&_r=1[/url]

I don't underestand following two items:

1) Session state is protected from unauthorized access.
2) Session identifiers are not passed in query strings.

How an unauthorized access to session state can happen and why would i pass
session identifier in query string ?

Thanks,
Ali

[bruce barker]

there are only a couple of ways to pass a session key

1) in a cookie (asp.net)
2) in the url
3) hidden field (though a url is often required for bootstrap)

your worried about how easy it is to hijack someone's session. in all the
above techinques the session key can be discovered by a network sniffer. so
now that i have the key, how easy is to use. a sample of a bad session key,
is an incrementing number, these are easy to hijack.


-- bruce (sqlwork.com)



"A.M" <IHateSpam@sapm123.com> wrote in message
news:#FN9LBZ9DHA.3648@TK2MSFTNGP11.phx.gbl...

> Hi,
>
> In Architecture and Design Review Security Checklist at following link:
>
>

[url]http://msdn.microsoft.com/library/en-us/dnnetsec/html/CL_ArchDes.asp?frame=t[/url]
rue&_r=1

>
> I don't underestand following two items:
>
> 1) Session state is protected from unauthorized access.
> 2) Session identifiers are not passed in query strings.
>
> How an unauthorized access to session state can happen and why would i

pass

> session identifier in query string ?
>
> Thanks,
> Ali
>
>

[Yan-Hong Huang[MSFT]]

Hello Ali,

I agreed with Bruce on it. For an example, if a client browser doesn't
support/allow cookie, we can't store session in cookie then. Under this
situation, some web sites will transfer session ID through URL. If somebody
hacked sessionID by using network sniffer, he can visit the web site by
using another people's identity.

Another concern is that cookies are sent between browser and server as
plain text, and anyone who can intercept your Web traffic can read the
cookie. You can set a cookie property that causes the cookie to be
transmitted only if the connection uses the Secure Sockets Layer (SSL, aka
[url]https://)[/url]. SSL does not protect the cookie from being read or manipulated
while it is on the user's computer, but it does prevent the cookie from
being intercepted in transit.

You can refer to the following article for some more info on it:
"Basics of Cookies in ASP.NET"
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechar[/url]
t/html/vbtchaspnetcookies101.asp

Hope that helps.

Best regards,
Yanhong Huang
Microsoft Community Support

Get Secure! ¨C [url]www.microsoft.com/security[/url]
This posting is provided "AS IS" with no warranties, and confers no rights.