Site Security - Best Practises

Tech-Archive recommends: Speed Up your PC by fixing your registry

Hi there,

I have a site that uses encrypted javascript cookies to hold session data
particulary user site role data. Although this data is encrypted Ive just
realised that if i copy the encrypted role data from one cookie and paste it
into another cookie i can make requests to the site using elevated
priviledges.

So im wondering how everyone else gets around this when using cookie based
sessions (I run on shared hosting server sessions are not an option). The
way im see it im really vulnerable because the user is only authenticated
once at login and from there site and role data (which is passed in from the
cookie) is simply "believed" and used to provide site access.

How do you guys and girls do it?? Given i can copy paste the site role
string and reuse it, i dont see the point in encrypting it in the first
place. All someone needs to do is sniff the cookie of a higher priviledged
user and then use the encrypted site role info in their own cookie....they
dont need to decrypt/crack anything.

Thanks

Richard


.

Relevant Pages

  • Re: Site Security - Best Practises
    ... It's called "Session Hijacking". ... RC> data particulary user site role data. ... RC> from one cookie and paste it into another cookie i can make requests ... RC> role string and reuse it, i dont see the point in encrypting it in ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to use SSL for login page only
    ... I get why constantly encrypting the cookie is important because you don't ... that folder that it always requires SSL and then putting allo f the sensitive ... "Joe Kaplan" wrote: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Does My Auto Login Strategy Make Sense?
    ... If the cookie is stolen, the attacker will be able to log. ... I'm planning on encrypting the password and ... Because the TextMode is Password, I can't figure out a way ... I'd like to just assign the stored password to the field. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Roles in encrypted cookie, security problem?
    ... The decryption with which you are concerned is generally not a very big ... worry (assuming you are actually encrypting as per the protection level ... cookie would be another easily configurable protective mechanism. ... Another type of protection would be to require some form of additional ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: XSS with encrypted cookie?
    ... I didn't get "encrypted session token cookie". ... random nothing can be achieved by encrypting it. ... to fetch a cookie through XSS attack and replay the session. ...
    (Pen-Test)