Secure Flag for ASPXAUTH Cookie

Question

We have an externally facing application which was penetration-tested by an external security company. Application has been developed on ASP.NET MVC4 and running on IIS8/Windows

Answer 1

I found this piece of code to which made my authentication cookie secure. I cant remember the source of this but if you add it to your global.asax, it sorts the issue. I do not know why but requireSSL=true in your tag was not enough to make it secure.

  protected void Application_EndRequest(Object sender, EventArgs e)
    {
        string authCookie = FormsAuthentication.FormsCookieName;

        foreach (string sCookie in Request.Cookies)
        {
            if (sCookie.Equals(authCookie))
            {
                // Set the cookie to be secure. Browsers will send the cookie
                // only to pages requested with https
                var httpCookie = Response.Cookies[sCookie];
                if (httpCookie != null) httpCookie.Secure = true;
            }
        }
    }

Answer 2

Answer for your secong question

Possible duplicate of How to secure .ASPXAUTH token

as per answer by xelco

To prevent forms authentication cookies from being captured and tampered with while crossing the network, ensure that you use SSL with all pages that require authenticated access and restrict forms authentication tickets to SSL channels by setting requireSSL="true" on the <forms> element.

To restrict forms authentication cookies to SSL channels set requireSSL="true" on the <forms> element, as shown in the following code:

<forms loginUrl="Secure\Login.aspx" requireSSL="true" ... />

By setting requireSSL="true", you set the secure cookie property that determines whether browsers should send the cookie back to the server. With the secure property set, the cookie is sent by the browser only to a secure page that is requested using an HTTPS URL.

Answer 3

Your issue looks to be that because your form is incorrectly configured. You have:

<forms ... requireSSL="" ... />

and you should have

<forms ... requireSSL="true" ... />

According to Microsoft the requireSSL attribute in the httpCookies tag is overridden by the requireSSL attribute of the forms tag. You didn't set the value, but you specified it may cause IIS to use the default of false. You should set it to true.

Answer 4

An alteration to AnarchistGeek's answer: you don't want to iterate over Request.Cookies directly because adding a cookie by using the response collection makes the cookie immediately available in the request collection (see the note in the HttpRequest.Cookies docs here). That will leave you with a "Collection was modified after the enumerator was instantiated" error when you go to set/alter the response .ASPXAUTH cookie, because it is also modifying the request collection.

protected void Application_EndRequest(Object sender, EventArgs e)
{
    string authCookie = FormsAuthentication.FormsCookieName;
    string[] cookieNames = Request.Cookies.AllKeys;

    foreach (string sCookie in cookieNames)
    {
        if (sCookie.Equals(authCookie))
        {
            var httpCookie = Response.Cookies[sCookie];
            if (httpCookie != null) httpCookie.Secure = true;
        }
    }
}

Note that this particular solution will clear the existing value of the .ASPXAUTH cookie (see this post)