asp.net - 我们是否需要保护 cookie .ASPXANONYMOUS

Question

您能否告知我们是否需要保护 cookie.ASPXANONYMOUS 的安全？

谢谢。

Answer 1

如果您确定仅应将匿名用户 cookie 保护到 SSL，那么您可以在 web.config 中使用 anonymousIdentification 进行调整。元素。

<anonymousIdentification  
   enabled="true"
   cookieRequireSSL="true"
/>

cookieRequireSSL
Specifies whether the cookie requires a Secure Sockets Layer (SSL) connection when it is transmitted to the client. Because ASP.NET sets the authentication cookie property, Secure, the client does not return the cookie unless an SSL connection is in use. The default is false.