3

I'm new to webdev in ASP.net.

My Problem is how to ensure a safe "Remember me" functionality. At the moment i'm serializing an object to a cookie to authenticate the user in future.

But now my thought was, if someone copies my cookie he will be able to login with the hacked person's account. Is there a more safe version of remembering the login of someone between different sessions?

Best regards

1

2 Answers 2

3

A "remember me" cookie will typically contain a long lived session key. You can make it harder to use a stolen cookie by storing extra information about the computer environment where the cookie was originally created and check this information before you accept the cookie. This is called "device fingerprinting". It can be quite precise, but its not very easy to do and not 100% secure.

The ip-number can be a part of a device fingerprint, but ip-numbers on mobile devices changes very often so that would reduce the value of the cookie quite considerably. You may check http header fields like "User-Agent", "Accept", "Accept-Language" etc. These fields will usually be different on two different browsers. You can use javascript and check the os version, the java version etc. etc.

Storing a device fingerprint on the server along with the session key will make the remember-me-cookie a bit stronger. However, it is still not very secure. An attacker that steals the cookie will probably be able to also collect all this information.

PS: Also remember that the user should be able to de-activate the remember-me-cookie if he knows that the cookie is lost, i.e. if his computer is stolen.

0

You could store some extra information in the cookie like client IP address.

4
  • This wouldn't fix the problem of "Copy-Paste"'ing my cookie... because i also want to provide unlimited remembering
    – kyjan
    Mar 23, 2012 at 20:39
  • 1
    -1 The OP specifically asked about security, but if two machines are behind a router with NAT they will both appear to have the same IP address. So anyone else behind the same router could steal the cookie and break the security. Mar 23, 2012 at 20:48
  • 1
    It wouldn't handle some other user on the same computer copying it, but another person copying it won't likely have the same IP...Now, there are other, better things you can store than IP, but the concept is moving in the right direction.
    – Servy
    Mar 23, 2012 at 20:51
  • But if the IP changes my user has to login again.
    – kyjan
    Mar 23, 2012 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.