Details
The cookie protection mode defines the protection Forms Authentication cookies will be given within a configured application. The four cookie protection modes that can be defined are:
o Encryption and validation – Specifies that the application use both data validation and encryption to help protect the cookie; this option uses the configured data validation algorithm (based on the machine key) and triple-DES (3DES) for encryption, if available and if the key is long enough (48 bytes or more)
o None – Specifies that both encryption and validation are disabled for sites that are using cookies only for personalization and have weaker security requirements
o Encryption – Specifies that the cookie is encrypted by using Triple-DES or DES, but data validation is not performed on the cookie; cookies used in this manner might be subject to plain text attacks
o Validation – Specifies that a validation scheme verifies that the contents of an encrypted cookie have not been changed in transit
It is recommended that cookie protection mode always encrypt and validate Forms Authentication cookies.
By encrypting and validating the cookie, the confidentiality and integrity of data within the cookie is assured. This helps mitigate the risk of attacks such as session hijacking and impersonation.
NOTE: This requires .Net Extensibility or ASPNET45 component, but neiter component was not found.
Supportive Information
The following resource is also helpful.
This control applies to the following type of system Windows.