4

Due to a bug in Flash, I have to use the ASPXAuth cookie to log a user in on a page that a flash upload script calls after upload. See this page for more information: Link

I have to make the ASPXAUTH string "public" in the sense that it will be in the HTML of the page. My question is, how secure is this?

I understand that anyone that can get to the string in the HTML can probably get to it from the cookie just as easily, but let's say someone does have this ASPXAUTH string. Is it possible that they can login as another user using this cookie? Would they be able to decrypt it?

Bara

Glorfindel
  • 21,988
  • 13
  • 81
  • 109
Bara
  • 1,113
  • 6
  • 18
  • 28

2 Answers2

4

The value of the Forms Authentication cookie could be decrypted if a 3rd party had obtained the decryption key used by your website. Otherwise, I guess it would be a case of using brute force methods to crack it.

pmarflee
  • 3,428
  • 20
  • 21
  • Do you feel it is safe to write the auth cookie to HTML for use in javascript? – Bara Mar 19 '10 at 04:56
  • Yes, because anyone can view the value in the first place by looking in the cookie. It is only once that value arrives to the server that it is decrypted and used to initialize user id, access user data, etc... So, if someone wanted to log in as different user, he would need to able to decrypt your cookie, change the UserID value, again encrypt everything and then send it to the server. – nikib3ro May 12 '11 at 20:04
  • @Bara, I certainly don't. What kape123 says only holds if you don't use SSL. If you do, and mark the cookie Http-only and secure, then only the end-user can access it —no problem since after all it represents his/her identity— but certainly not anyone. By allowing JavaScript to access it, you open it up to any injected code, which could allow identities to be stolen. – Chris Wesseling Jun 27 '12 at 14:21
1

Make sure you prevent the page from caching at both client , proxy and server.

You really don't want the page to be stored in any caches if it contains aspxauth cookie values in the markup.

Personally I would use SSL for the connection if it was very sensitive data.

Geo
  • 11
  • 1