SSL How-TO

[Guest]

Hi
Can we set SSL enable only for the login page, in an ASP.NET application
TIA

--

 

[Dominick Baier [DevelopMentor]]

Hello dl,

i guess you are using FormsAuth - so authentication is based on a cookie.
This cookie has to be transmitted to every pages that requires authentication.

This would mean that you secure the login page, but all remaining pages will
receive the cookie in clear text. If someone can steal/sniff that cookie
he can hijack the authenticated users identity.

or short - No.

 

[Guest]

I thought the content of the authentication cookie is an encrypted session
ticket, with no username / password information, isn't it?

 

[Joe Kaplan \(MVP - ADSI\)]

Yes, but if they sniff the cookie they can still replay it and assume your
identity on the website. You generally want to be careful about passing
around forms auth cookies on an unencrypted channel.

Joe K.