CODEWITHSUNDEEP
c#asp.net-mvcsessionsession-cookies
לבני מלכה
לבני מלכה

Reputation: 16251

Prevent change "ASP.NET_SessionId" by user c#

I tried to prevent user for changing the "ASP.NET_SessionId"

I tried this code:

Response.Cookies["ASP.NET_SessionId"].Value = GenerateHashKey();

But my session (Session["userId"]) was removed when I tried to set the cookie

Here is some code that I tried without success:

protected void Application_BeginRequest(object sender, EventArgs e)
{

    //Check If it is a new session or not , if not then do the further checks
    if (Request.Cookies["ASP.NET_SessionId"] != null && Request.Cookies["ASP.NET_SessionId"].Value != null)
    {
        string newSessionID = Request.Cookies["ASP.NET_SessionID"].Value;
        //Check the valid length of your Generated Session ID
        if (newSessionID.Length <= 24)
        {
            //Log the attack details here
            Response.StatusCode = 401;
        }

        //Genrate Hash key for this User,Browser and machine and match with the Entered NewSessionID
        if (GenerateHashKey() != newSessionID.Substring(24))
        {
            //Log the attack details here
            Response.StatusCode = 401;
            //throw new HttpException("401");
        }
        //Use the default one so application will work as usual//ASP.NET_SessionId
        Request.Cookies["ASP.NET_SessionId"].Value = Request.Cookies["ASP.NET_SessionId"].Value.Substring(0, 24);
    }
}

private string GenerateHashKey()
{
    StringBuilder myStr = new StringBuilder();
    myStr.Append(Request.Browser.Browser);
    myStr.Append(Request.Browser.Platform);
    myStr.Append(Request.Browser.MajorVersion);
    myStr.Append(Request.Browser.MinorVersion);
    SHA1 sha = new SHA1CryptoServiceProvider();
    byte[] hashdata = sha.ComputeHash(Encoding.UTF8.GetBytes(myStr.ToString()));
    return Convert.ToBase64String(hashdata);
}


protected void Application_EndRequest(object sender, EventArgs e)
{
    //Pass the custom Session ID to the browser.
    if (Response.Cookies["ASP.NET_SessionId"] != null)
    {
        Response.Cookies["ASP.NET_SessionId"].Value = Request.Cookies["ASP.NET_SessionId"].Value + GenerateHashKey();
    }

}

How to prevent the user for set session enter image description here

Upvotes: 1

Views: 3038

Answers (1)

Athanasios Kataras
Athanasios Kataras

Reputation: 26430

Looks like you are trying to secure your session value from tampering? If you set the value yourself, you override the session identifier and destroy the purpose of the asp session cookie.

ASP.Net_SessionId is a cookie which is used to identify the users session on the server. The session being an area on the server which can be used to store data in between http requests.

If you are trying to solve the session fixation problem, which is the only vulnerability of asp session cookie, then you need to introduce a new cookie like this: https://medium.com/@grep_security/session-fixation-broken-authentication-and-session-management-c37ce0111bf5

Upvotes: 1

Related Questions