Question

I want to secure my cookies, i read about "HTTPOnly" and "Secure" cookie flags for the ASP.NET_SessionId cookie. I create new asp.net project in VS. And in fiddler in Inspectors -> raw i have:

Cookie: DXCurrentThemeMVC=Office2010Black; ASP.NET_SessionId=1gq0t1mi234xyljqnxrzbqfx

Then i modify web.config :

<system.web>
    <compilation debug="true" targetFramework="4.0" />

    <httpCookies httpOnlyCookies="true" requireSSL="true"/>

    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login.aspx" timeout="2880" requireSSL="true" />
    </authentication>

但用同样的数据计算。

 Cookie: DXCurrentThemeMVC=Office2010Black; ASP.NET_SessionId=1gq0t1mi234xyljqnxrzbqfx

I think when i add <httpCookies httpOnlyCookies="true" requireSSL="true"/> i cant see cookies in fiddler, or cookies will be encrypted. Is this correct result ? Or i have mistake somewhere?

http://www.ohchr.org。

以及为什么在幼 in中看到

Set-Cookie: ASP.NET_SessionId=ig2fac55; path=/; secure; HttpOnly

but only cookie without set-, and secure, and HttpOnly also in firebug i see the same results

EDIT2 It seems like i find my problem: i host app on iis and in firebug look for cookies, and i have cookies with secure and httpOnly Flags:

ASP.NET_SessionId=98sfd90sdf89sd0f80s8; path=/; secure; HttpOnly

Answer 1

查阅。

httpOnlyCookies sets the HttpOnly flags in response header. See Protecting Your Cookies: HttpOnly article.

RequireSSL 强迫通过安全渠道转移的 co,从而避免移走,并在运输过程中加以加密。

Answer 2

确保库克群岛能够使用IDataProtector加密贵重物品

页: 1 班级:

private IDataProtector dataProtector;

public HomeController(IDataProtectionProvider provider)
{
    //TODO:Set Your Private Key
    dataProtector = provider.CreateProtector("YourPrivateKey");
}

您可以在其方法中使用:

public IActionResult SetNewCookie(string key,string value) {

        var cookieOptions = new CookieOptions();
        cookieOptions.Secure = true;
        cookieOptions.HttpOnly = true;

        HttpContext.Response.Cookies.Append(key,dataProtector.Protect(value),cookieOptions);
        return View(nameof(Index));
}

并且最后,为了贬低我们能够使用的 co价值:

dataProtector.Unprotect(value);

Im 还使用“CookieOptions”,并为更多的安全(如果你重新使用第三方软件,将更难获得厨师)设定安全可靠的和网上安全。

友情链接