asp.net mvc login user using formsauthentication cookieless

Question

I'm writing a custom membership provider that uses LINQ to manage my users. I'm also creating my own tables to manage a user. How would I login a user using the FormsAuthentication object if I want auth to be cookieless?

Troy Hunt · Accepted Answer · 2011-08-05 22:10:11Z

2

You really want to avoid cookieless session persistence at all costs. It means persistence via the URL which is very vulnerable to session hijacking. Take a look at the example in OWASP Top 10 for .NET developers part 3: Broken authentication and session management.

Are you really confident you have clients authenticating who don't support cookies and you willing to compromise security for these individuals?

answered Aug 5, 2011 at 22:10

Troy Hunt

20.5k14 gold badges99 silver badges151 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Internet Engineer · Accepted Answer · 2011-08-05 13:58:56Z

1

In regular asp.net IIS manages that for you by inserting the session id in the URL.

By the way this is not the safest approach, as the session can be stolen.

http://msdn.microsoft.com/en-us/library/aa479314.aspx

answered Aug 5, 2011 at 13:58

Internet Engineer

2,54410 gold badges41 silver badges54 bronze badges

1 Comment

Kristofer Hoch Over a year ago

Also, using session would be problematic if you're using load balancing servers.

Collectives™ on Stack Overflow

asp.net mvc login user using formsauthentication cookieless

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related