Hijack Session

[Dave]

Has anyone seen any good examples of how to stop someone
from stealing the session id to hijack the session?

Thanks...

 

[Chris Jackson]

Well, the only way to really do this is to prevent somebody from gettng the
session id in the first place - this is the danger of cookieless session
state, where it is in the URL for all to see. Once somebody has the ID,
there isn't anything you can do to differentiate that person from the
legitimate user. If information is extremely senstive, then don't use
persistent cookies (so they won't be sitting on disk) and use HTTPS so it's
encrypted over the wire. Require authentication again when you get to
something particularly sensitive.

 

[Keith]

An apporach I'm considering is to:

1. Store the source IP and user agent
2. Compare the request IP and user agent on each page to
the session ID
3. Not use cookieless sessions
4. Not persist the ticket

This will give me the security I need to get ASP.Net
working in my organization.