FormsAuthentication: Is it secure?

Question

Using FormsAuthentication build into asp.net it\'s very quick and easy to create a login system that creates a cookie for authenticated users:<

Answer 1

If you set the DisplayRememberMe property to false the cookie will not be persisted on the client machine. It will then just be stored in memory.

If you use HTTPS/SSL it will be protected on the way to the client machine.

There are then only theoretical possibilities left:

• Break the SSL encryption
• Steal the cookie from the memory of the client machine

Followed by breaking the encryption on the cookie.

There are probably some easier ways to attack your system.

http://msdn.microsoft.com/en-us/library/ms998310.aspx