2

I am using ASP.NET Forms authentication method and use certain encryption and decryption key in machinekey tag and set slidingexpiration to true and 20 minutes timeout. Now I have a question: If anyone steals my cookie, can he/she login with my account anywhere? (because the encryption is always constant) And if the answer is no, how the cookie values change in every request?

Thanks

EDITED: If the cookies change in every request, where the encryption key is stored? And how the application knows what is the key to decrypt data?

2

1 Answer 1

2

The cookie holds the Forms authentication ticket. With sliding authentication, the date that is stored in the ticket could be updated with any request that is checked by the server. That is why you would see cookie values changing.

The cookie (or ticket) is vulnerable to theft and can certainly be used to hijack a session. See this Microsoft article for more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.