Securing The .Net Cookies
Posted by James Jardine on October 13, 2015 · Comments Off on Securing The .Net Cookies
Filed under: Development, Security
Filed under: Development, Security
I remember years ago when we talked about cookie poisoning, the act of modifying cookies to get the application to act differently. An example was the classic cookie used to indicate a user's role in the system. Often times it would contain 1 for Admin or 2 for Manager, etc. Change the cookie value and ...
ASP.Net Insufficient Session Timeout
Posted by James Jardine on October 6, 2015 · Comments Off on ASP.Net Insufficient Session Timeout
Filed under: Development, Security, Testing
Filed under: Development, Security, Testing
A common security concern found in ASP.Net applications is Insufficient Session Timeout. In this article, the focus is not on the ASP.Net session that is not effectively terminated, but rather the forms authentication cookie that is still valid after logout. How to Test User is currently logged into the application. User captures the ASPAuth cookie ...
Follow Us
