How do you protect Forms Authentication cookies against tampering and replay attacks?

Question

ICSM Computer · Answer

To protect Forms Authentication cookies against tampering and
replay attacks in ASP.NET (including ASP.NET MVC and Web Forms), you should take the following measures:
1. Enable Cookie Protection (Encryption + Signing)
Forms Authentication cookies are protected using encryption and
validation (HMAC signature) by default.
Ensure this in your web.config:
andlt;system.webandgt;
  andlt;authentication mode="Forms"andgt;
    andlt;forms name=".AUTH" protection="All" timeout="30" /andgt;
  andlt;/authenticationandgt;
  andlt;machineKey validationKey="AUTO" decryptionKey="AUTO" validation="HMACSHA256" decryption="AES" /andgt;
andlt;/system.webandgt;
protection="All" ensures both encryption and 
HMAC validation.validationKey and decryptionKey should be explicitly set (not
AUTO) in load-balanced environments.
2. Use Secure Cookies
Set the requireSSL="true" and cookieSecure="Always" if your app runs over HTTPS:
andlt;forms name=".AUTH" protection="All" timeout="30"
       requireSSL="true" cookieless="UseCookies" /andgt;
This prevents cookie interception over insecure channels.
3. Enable Sliding Expiration and Short Timeout
Use shorter session timeouts and consider enabling sliding expiration to limit replay opportunities:
andlt;forms timeout="20" slidingExpiration="true" /andgt;
4. Use the HttpOnly and
Secure Flags
Ensure the cookie cannot be accessed via JavaScript:
andlt;httpCookies httpOnlyCookies="true" requireSSL="true" /andgt;
This helps mitigate XSS attacks which can lead to cookie theft.
5. Prevent Cross-Site Request Forgery (CSRF)
Use anti-forgery tokens (@Html.AntiForgeryToken() in MVC) to prevent forged requests even if the cookie is stolen.
6. Use Session Validation (optional custom defense)
To protect against replay attacks, you can:
Store a session-specific token (e.g., IP address, User-Agent, or nonce) in the ticket or session store.On each request, compare current request info with the one stored.
7. Regenerate Ticket on Sensitive Changes
On login or privilege escalation, regenerate a new ticket to invalidate old ones.
Summary
Threat
Protection Mechanism
Tampering
HMAC validation with machineKey, protection="All"
Eavesdropping
requireSSL="true", HTTPS, cookieSecure="Always"
Replay Attacks
Short timeouts, regenerate tickets, session checks
Cookie Theft
HttpOnly, secure flag, CSRF protection

interview

How do you protect Forms Authentication cookies against tampering and replay attacks?

ICSM Computer

Can you answer this question?

1 Answers

1. Enable Cookie Protection (Encryption + Signing)

2. Use Secure Cookies

3. Enable Sliding Expiration and Short Timeout

4. Use the `HttpOnly` and `Secure` Flags

5. Prevent Cross-Site Request Forgery (CSRF)

6. Use Session Validation (optional custom defense)

7. Regenerate Ticket on Sensitive Changes

Summary

Liked By

Threat	Protection Mechanism
Tampering	HMAC validation with `machineKey`, `protection="All"`
Eavesdropping	`requireSSL="true"`, HTTPS, `cookieSecure="Always"`
Replay Attacks	Short timeouts, regenerate tickets, session checks
Cookie Theft	`HttpOnly`, secure flag, CSRF protection

interview

How do you protect Forms Authentication cookies against tampering and replay attacks?

ICSM Computer

Can you answer this question?

1 Answers

1. Enable Cookie Protection (Encryption + Signing)

2. Use Secure Cookies

3. Enable Sliding Expiration and Short Timeout

4. Use the HttpOnly and Secure Flags

5. Prevent Cross-Site Request Forgery (CSRF)

6. Use Session Validation (optional custom defense)

7. Regenerate Ticket on Sensitive Changes

Summary

Liked By

4. Use the `HttpOnly` and `Secure` Flags