Using ASP .NET forms authentication, if a fresh authentication cookie was stolen, would it be useable on another PC?

Question

If an attacker copied the authentication cookie that is placed in the SetAuthCookie call, from the victims PC to their PC, would the attacker be considered authenticated by the web application?

public static void SetAuthCookie(
    string userName,
    bool createPersistentCookie
)

Using standard forms authentication FormsAuthentication.SetAuthCookie and the argument createPersistentCookie = false

Assume this for web configuration settings

<authentication mode="Forms">
    <forms name="MyWebApp" path="/" loginUrl="~/Default.aspx"
     timeout="30" defaultUrl="~/Default.aspx" protection="All"
     requireSSL="true" />       
</authentication>

Answer 1

Yes; ASP.Net does not include the IP address in auth cookies. (and that wouldn't even help for shared WiFi or proxies)

However, since you have requireSSL="true", attackers will (in principle) not be able to get that cookie. (unless they have access to the server or the client, in which case you have bigger problems)

This is why you should always use SSL.