tailieunhanh - Professional ASP.NET 2.0 Security, Membership, and Role Management phần 6

Quan trọng hơn, các tính năng thực hiện công việc và tiêu thụ các thông tin cấu hình có thể tự mình luôn luôn được gọi với mã đáng tin cậy trên stack. Kịch bản giống như các lớp GAC'd được HttpModules có vấn đề này. HttpModule một chỉ có | Session State When Abandon is called in the case of the SQL Server based provider an immediate delete command is issued and the session data is removed from the database. If you then access another page in the application thus recreating the session data the same session ID is retained shown in bold but a new row in the database is created with new values for the creation and expiration date. Sessionld Created cqiyhanqbi2xk2vksixmybi108a8b5d6 2005-05-23 20 50 If you happen to be developing a standalone application and thus you don t need the session identifier to remain stable across different applications you can issue a clear cookie from your logout logic. However this is the only scenario where explicitly clearing the session cookie can be done because there aren t any other applications relying on the value. Protecting Session Cookies As with forms authentication in the session state feature explicitly sets the HttpOnly property on the cookie to true. Because applications store interesting information inside of session state protects the session identifier from client-side cross-site scripting XSS attacks for more details on XSS attacks and other security features of HttpOnly cookies see the discussion in Chapter 5 on forms authentication cookies . The likelihood of an attacker ever guessing a live session cookie is astronomically low with 120 bits in the session identifier that works out to an average of 2A60 guesses required. Come back in the next millennia when you finally get a match. That pretty much leaves cookie hijacking as the most viable option for getting to someone else s session data hence the addition of HttpOnly protection in . The theory is that few if any applications should harvest the session identifier client-side for other uses. Typically developers slipstream off the value of in their server-side logic and don t need to pass it around client-side. As a result of risks of .