I get that regular ASP finagles statefullness using viewstate, but MVC doesn't try to perpetuate the bold-faced lie of statefulness. So how is it able to maintain sessions?
By default it stores a randomly generated number in a cookie and stores that in memory. If the browser says it doesn't support cookies, asp.net will then instead add the session key in the url, it will show up like http://myurl.com/(S(rpfa4y3c5oe2c555ljanprek))/Controller/Action
It is using a Session ID to identify a user, stored in Cookies. Spoofing is possible if your know the victim's ID, and if other security measurements won't interfere (e.g IP based authentication).
Related
I'm exploring cookies and sessions [I'm using them with respect to ASP.NET C# microsoft framework]
Learnt how sessions and cookies work here and here.
My take on it is like,
Once a user logs in and establishes a session, he or she is given a session id to track them further.
Also, this sessionId can be stored on a Server, like SQL Server or a InProc, meaning it is stored on the issuing server or on a cache, Redis Cache.
My question is like,
I can understand that the sessionId is stored in a memory and being sent with every request (since HttpSessions are stateless) as HttpHeaders.
When we talk about storing sessions in a memory, which memory are we talking about ?
If we are storing them in a cookie, what If I go and modify the cookie ?
If I can modify them, what If I change the sessionId and supply in a new sessionId ?
1. When we talk about storing sessions in a memory, which memory are we talking about ?
Ans: InProc mode, which stores session state in memory on the Web server (RAM). This is the default.
2. If we are storing them in a cookie, what If I go and modify the cookie ?
Ans : Only session id is stored in cookie. If you don't want to use cookies for session tracking, asp.net framework also supports it by appending it in the URL. If you change the cookie value, the server will not be able to identify the request with the stored session data. You need to understand the http is a stateless protocol, sessionid is the identifier of a browser for the request during roundtrips. If you change the cookie value, server will not be able to identify the request.
By luck if you supply a valid sessionid, server will serve the content stored in session against that id. This is called session hijacking
https://en.wikipedia.org/wiki/Session_hijacking
3. If I can modify them, what If I change the sessionId and supply in a new sessionId ?
Ans: If you are taking about the SessionId of System.Web.SessionState. It can't be changed as it is readonly. But you are free to change anything at the client side (Cookie or URL)
Namespace: System.Web.SessionState
Assembly: System.Web (in System.Web.dll)
public string SessionID { get; }
The session data is stored on the server, either in memory or in a database. This data is looked up with a sessionId that is stored in a cookie.
2/3. Modifying the sessionId is known as session hijacking, and allows you to "be" that user. This is commonly exploited with attacks like cross-site scripting (XSS).
To protect against hijacking make sure that:
The cookie is encrypted. There are ways for ASP.NET to do this for you, but this way it cannot be tampered with
The cookie is set to HttpOnly. This ensures that the cookie can only be sent over http requests and things like javascript - and thus XSS attacks - don't have access to the cookie.
If you are using something like ASP.NET Session State, change the default name of the cookie so it is not easily recognizable
I have a website with two different domain.
us.site.com
usa.site.com
Now when user Click on Login
It first check its country. According to country I want to redirect whole site on that url and that time it not again asks for account id and password. so i want to maintain these things but it should not visible in Url.
Please Suggest me any way to do this.
I don't want to use QueryString and Cookie
Posting my comment as an answer.
Basic idea as following. You can use cookies. On login, create a cookie for "site.com" having user information. When user redirects to for say login to usa.site.com, check the cookies in pageload. If you found the cookies read the cookies and convert it to session. Use session further to check loogged in user information.
Related question link,
How can you keep a session across multiple subdomains in c# mvc?
How can I share a session across multiple subdomains in ASP.NET?
Write cookies from subdomain and read from another subdomain without changing web.config
To make cookie secure use encryption.
Reference :
http://www.codeproject.com/Articles/13665/HttpSecureCookie-A-Way-to-Encrypt-Cookies-with-ASP
Encrypt cookies in ASP.NET
http://www.c-sharpcorner.com/UploadFile/manishkdwivedi/encrypting-and-decrypting-cookies-in-Asp-Net-2-0/
Use MD5/SHA Encryption to store value in cookie and once you redirect to other page then use decryption Algo and use that cookie value.
It will solve your issue.. Check below link for reference -
http://www.codeproject.com/Articles/38951/How-To-Hash-Data-Using-MD-and-SHA
http://www.codeproject.com/Articles/14150/Encrypt-and-Decrypt-Data-with-C
http://www.codeproject.com/Articles/12602/Using-MD-Encryption-with-C-and-MSSQL
Or you can use alternative way to store value in database temp table
Is it possible to use TempData when cookies are disabled? I have a redirect check that depends on a TempData key, but when cookies are disabled, that key is always null.
TempData is a way to persist something between HTTP requests. Because HTTP is inherently stateless, you can't persist something without having a way to identify the client.
TempData uses the Session as storage, which by default uses cookies to persist a user's session between HTTP requests. A cookie is included in every request with a key to that particular user's session.
If you want TempData to work without cookies, you can set the cookieless="true" attribute of the sessionState tag in your web.config file. That appends a query string parameter to every link in your site to achieve the same result. However, it's not recommended and you will have issues if you're using MVC 4.
If you want it to work without using cookies, include a query string parameter on the target URL instead if possible.
It depends on the TempDataProvider of the Controller. the default provider is SessionStateTempDataProvider which relies on the regular Session State Storage.
That basically means that if Cookies are disabled, you won't have neither Session or TempData unless you'll implement Cookie-less Session.
basically, if cookeis are disabled on the client, im wondering if this...
dim newCookie = New HttpCookie("cookieName", "cookieValue")
newCookie.Expires = DateTime.Now.AddDays(1)
response.cookies.add(newCookie)
notice i set a date, so it should be stored on disk, if cookies are disabled does asp.net automatically store this cookie as a session cookie (which is a cookie that lasts in browser memory until the user closes the browser, if i am not mistaken).... OR does asp.net not add the cookie at all (anywhere) in which case i would have to re-add the cookie to the collection without the date (which stores as a session cookie)... of course, this would require me doing the addition of a cookie twice... perhaps the second time unnecessarily if it is being stored in browsers memory anyway... im just trying not to store it twice as it's just bad code!! any ideas if i need to write another line or not? (which would be)...
response.cookies.add(New HttpCookie("cookieName", "cookieValue") ' session cookie in client browser memory
thanks guys
This MSDN article seems to indicate that there is no built in mechanism for compensating with the user disabling cookies. It also indicates that session state does not work without at least some level of cookies being enabled.
I thought that there was a mechanism for passing a query variable for the session id but skimming the article (quickly) I did not see this.
Hope that helps.
EDIT: It does say that you can use cookieless sessions (I thought you could). They use a separate mechanism to embed session ID in the pages and url links.
To follow up on GrayWizardx's reply, much of what was said is completely accurate.
If you are using a Cookie'd version of Session, and cookies are disabled then you are out of luck. But you have the option to have a cookieless version of the Session, which adds a string to the URL that shows the users session id. This is very ugly looking, and has always concerned me from a security perspective.
So you have three options (that I can think of off the top of my head):
1. Require cookies. This is not a bad thing, especially if your site is one that would have requiring cookies as normal.
2. Use ViewState.
3. Pass information from page to page within the URL. This, again worries me from a security perspective.
I'm working on a mobile site where we can't rely on the phone hitting the site to have cookie support. I'm using the cookieless option for sessions and wondering if there's a way to specify where in the URL that the sessionId gets placed?
Here's what it looks like now:
http://www.somesite.com/(S(qnxbzt45h2yxpr45tj3hpr45))/Default.aspx
Is there a way to have the sessionId at the end of the url?
http://www.somesite.com/Default.aspx?S=qnxbzt45h2yxpr45tj3hpr45
Can you not store user sessions using a Sql Database instead? I don't think you can change the sessionId position, you could try re-writing the url's but I'm not sure how that would affect .Net's handling of it
EDIT: I just remembered that the Sql option still requires a cookie on the client machine so ignore me
Session options are set in the web.conf sessionState section. This is detailed here:
http://msdn.microsoft.com/en-us/library/h6bb9cz9(vs.71).aspx
Theres no way to setup the sessions like this with the built in session functionality of asp.net. Your best bet is to define your own session mechanism