Menu
I'm trying to write a cookie in ASP.NET under https, but I see a plain text cookie in the client machine. Shouldn't the cookie be encrypted by default under an https connection?
786
A cookie with the Secure attribute is only sent to the server with an encrypted request over the HTTPS protocol. It's never sent with unsecured HTTP (except on localhost), which means man-in-the-middle attackers can't access it easily. Insecure sites (with http: in the URL) can't set cookies with the Secure attribute.
A good approach is to prevent the client from knowing what the cookie means on the server. Encrypting the value of the cookie is a good way to mitigate this risk. If the value has encryption the client can't know what it means. This prevents attackers from sniffing cookie values and crafting attacks on the server.
Hypertext transfer protocol secure (HTTPS) is the secure version of HTTP, which is the primary protocol used to send data between a web browser and a website. HTTPS is encrypted in order to increase security of data transfer.
Cookie information makes shopping websites substantially easier to use. But digital cookies aren't programs. They're just little bits of text, usually encrypted, that browsers store on your PC or mobile device. They don't contain your user name or your email address or your passwords.
Your cookie will only be encrypted during transmission of the cookie to/from your browser. If you want the cookie to be encrypted in the browser's cookie store, you'd need to encrypt it on the server first and then decrypt on the server upon use in server side scripts.
SSL/TLS is just a transport security mechanism to encrypt requests/responses on the wire, it is up to the browser to provide a mechanism to store cookies securely on the client (or as mentioned above, your application can do this).
24
Short answer is no, cookies are not encrypted in ASP.NET under SSL. SSL is a transport-level protocol, encrypting only the communications between the client and server. Cookies and query-string values are NOT encrypted by SSL. Once the cookie is on the client machine, it is left in whatever format it left the server in.
93
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
