Contents
You should always set the Secure flag in your cookies when they contain sensitive data, unless your website uses an insecure connection, but in that case you have much bigger problems.
Mark cookies as Secure Cookies. Add( new HttpCookie(“key”, “value”) { Secure = true, }); That’s it! Cookies are now only sent over HTTPS, making it impossible to intercept any cookies accidentally sent over HTTP (you still want to eliminate those calls if any).
When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTPS). Although seemingly useful for protecting cookies from active network attackers, the Secure attribute protects only the cookie’s confidentiality.
What is cookie expiration flaw?
Unlike other cookies, session cookies do not have an expiration date assigned to them, which is how the browser knows to treat them as session cookies. When a session cookie whose values contain sensitive data doesn’t expire with the session, it becomes a Persistent Session Cookie, introducing a security risk.
What is the maximum storage size of a cookie?
4096 bytes
According to Microsoft its 4096 bytes. cookies are usually limited to 4096 bytes and you can’t store more than 20 cookies per site. By using a single cookie with subkeys, you use fewer of those 20 cookies that your site is allotted.
Another more recent scheme in this area is SCS: Secure Cookie Sessions for HTTP, which is a solid scheme, very well thought-out. I recommend reading the security discussion of that document to get a good sense of what the security threats may be.
There are two ways to maintain session state: Store session state on the server. The web server feeds the browser a session cookie: a cookie whose only purpose is to hold a large, unguessable bit-string that serves as the session identifier.
What do you need to know about Cookie security?
As the name HTTPOnly implies, the browser will only use the cookie in HTTP (S) requests. This prevents hackers from using XSS vulnerabilities to learn the contents of the cookie. E.g. for the sessionId cookie it is never necessary to read the cookie with client-side script, so for sessionId cookies, you can always set the HTTPOnly flag.
How is session state maintained on the server?
There are two ways to maintain session state: Store session state on the server. The web server feeds the browser a session cookie: a cookie whose only purpose is to hold a large, unguessable bit-string that serves as the session identifier. Store session state on the client.