Details
Forms Authentication can be configured to maintain the site visitor’s session identifier in either a URI or cookie. It is recommended that Forms Authentication be set to use cookies.
Rationale:
Using cookies to manage session state may help mitigate the risk of session hi-jacking attempts by preventing ASP.NET from having to move session information to the URL. Moving session information identifiers into the URL may cause session IDs to show up in proxy logs, browsing history, and be accessible to client scripting via document.location.
NOTE: This requires .Net Extensibility or ASPNET45 component, but neither component was found.
Solution
1. Open IIS Manager and navigate to the level where Forms Authentication is enabled
2. In Features View, double-click Authentication
3. On the Authentication page, select Forms Authentication
4. In the Actions pane, click Edit
5. In the Cookie settings section, select Use cookies from the Mode dropdown
OR
Enter the following command in AppCmd.exe to configure:
%systemroot%system32inetsrvappcmd set config -section:system.web/authentication /forms.cookieless:’UseCookies’
OR
Enter the following command in PowerShell to configure:
Set-WebConfigurationProperty -pspath ‘MACHINE/WEBROOT/APPHOST/Default Web Site’ -filter ‘system.web/authentication/forms’ -name ‘cookieless’ -value ‘UseCookies’
Default Value:
The default setting for Cookie Mode is Auto Detect which will only use cookies if the device profile supports cookies.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.