FormsAuthentication.FormsCookiePath
Q1 Ive read that when setting an authentication cookie timeout, we must remember that the longer a cookie is kept, the more likely it is that the cookie will be stolen and misused.
A) But assuming that we are protecting our application from replay attacks by enabling SSL for the entire application, and since the forms authentication module also encrypts the authentication data in the authentication cookie, I would think there is no way to use this cookie and therefore cookies that last for longer periods of time shouldn't pose any security risks ?!
Q2
FormsAuthentication.FormsCookiePath specifies where the authentication cookie is stored. Default value: '/.
A) Assuming the default / is used, where is the cookie stored?
B) Is this option only used for persistent cookies?
thanks
a source to share
2A The cookie path is the path on the server to which the cookie belongs, not the path where the cookie is stored.
From http://www.quirksmode.org/js/cookies.html
The path gives you the option to specify the directory in which the cookie is active. Therefore, if you only want the cookie to be sent to pages in the cgi-bin directory, provide the path to / cgi -bin. Typically the path is set to /, which means the cookie is valid across the entire domain. This script does this, so the cookies you can set on this page will be sent to any page on the www.quirksmode.org domain (although only this page has a script that looks for cookies and does something with them) ...
You are using ASP.Net. Also check out the "CookieLess" and "Authenification" parameters, for example. http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.formscookiepath.aspx If you are worried about cookies. Instead, the session ID of the URL is used to track the session.
You can also use SQL Server to monitor session state or server state. eg.
<sessionState mode="SQLServer" sqlConnectionString="SQLSessionDB" cookieless="false" timeout="65" cookieName="MSESSID"/>
1A. SSL encrypts transport. Consequently, your cookies are less likely to be stolen on the way to and from the customer. This does not mean that malware on the client computer cannot steal it. However, this is unlikely.
a source to share