security - 如何保护 .ASPXAUTH token

Question

您如何保护 .ASPXAUTH token 以便它通过 SSL 发送。

Answer 1

直接来自 msdn docs :

To prevent forms authentication cookies from being captured and tampered with while crossing the network, ensure that you use SSL with all pages that require authenticated access and restrict forms authentication tickets to SSL channels by setting requireSSL="true" on the <forms> element.

To restrict forms authentication cookies to SSL channels set requireSSL="true" on the <forms> element, as shown in the following code:

<forms loginUrl="Secure\Login.aspx" requireSSL="true" ... />

By setting requireSSL="true", you set the secure cookie property that determines whether browsers should send the cookie back to the server. With the secure property set, the cookie is sent by the browser only to a secure page that is requested using an HTTPS URL.

注:使用 requireSSL="true" 时，仅针对通过 SSL 请求的页面发送 auth cookie。因此，如果您通过 HTTP(非 SSL)访问某个页面，您可能似乎没有登录。本文讨论了该问题并提出了一个与 SharePoint 站点相关的解决方案(但该理论是可转移的): Securing the authentication cookie for mixed SSL SharePoint sites