5

I have a website, its completely over HTTPS. Even if someone tries to access over HTTP he will be redirected to HTTPS. I am using forms authentication. Recently I changed a setting to make the site more secure and after that Session is not retaining values and is always returning null. The settings are,

<httpCookies httpOnlyCookies="true" requireSSL="true"/>
<sessionState cookieless="false"/>

I have no idea on how to fix this issue. How do I fix this issue? Also, is my site vulnerable if I do not use this setting? consider that everything else is secure.

1 Answer 1

4

You question is too general with out many clues, so I can give you some points to move on.

[1] set also the domain on the cookies, with out the www., so the cookie can be read and set even if by mistake the www is missing.

<httpCookies domain="yourdomain.com" httpOnlyCookies="true" requireSSL="true"/>

[2] you also need to setup the <forms... with similar parameters (and what ever else you have set)

<forms name=".klidi" path="/" requireSSL="true" cookieless="UseCookies" 
   domain="yourdomain.com" enableCrossAppRedirects="false" 
        slidingExpiration="true" />

[3] you also need to setup the <roleManager with similar parameters.

<roleManager enabled="true" cacheRolesInCookie="false" cookieProtection="All" cookieSlidingExpiration="true" 
           cookieTimeout="20" domain="yourdomain.com" cookieRequireSSL="true">

and last the most important set this line on your code before you try to set or use any cookie to see if by mistake you did not use secure connection https.

Debug.Assert(HttpContext.Current.Request.IsSecureConnection, "With out https, cookie will not work");

By setting the last line, on your computer when you make your site you can see and diagnose if the problem is coming from non secure connection, because from the moment you set the requireSSL to true, any simple connection will not hold any cookie.

Also try to clear your cookies in the case that the cookie exist as non secure and you have any conflict, and or try other browsers.

You can also read: Can some hacker steal the cookie from a user and login with that name on a web site?

2
  • Thanks you for the wonderful list. But now I see the problem is with this one page only now which is also the login page and the register page. I have started using viewstate instead of the session. But I am still not clear as why its only the login page causing the problem. The address of the page is www.eduheap.com/login Sep 20, 2012 at 8:57
  • @AshwinSingh Do you set any of this settings to see if they are work ?
    – Aristos
    Sep 20, 2012 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.