为什么 FormsAuthentication 的 requireSSL 属性默认为 false！
注意：这不是与 [RequireSSL] 属性相关的 ASP.NET MVC 问题。这是完全不同的 - 只是名称相同。
ASP.NET Forms 身份验证具有 RequireSSL 属性，要求 ASP.NET 成员资格的身份验证 cookie 只能通过 SSL 发送。这是为了防止有人窃取 cookie（例如通过网络嗅探）并冒充用户。
所以我想知道 - MS 所做的所有安全意识更改（例如使 httpOnly cookies 默认）为什么 requireSSL 没有默认为 true ？
Cookie 嗅探是否被视为“可忽略不计”的安全风险？
除非连接实际上允许我访问安全/个人数据，否则将其保留为 false 是否被认为是可接受的风险？如果这是不可接受的 - 我该如何将用户返回到 http 并且仍然知道他们是谁？
防止表单身份验证 cookie 被捕获和 穿越时被篡改 网络，确保您使用 SSL 所有需要验证的页面 访问和限制表单 SSL 通道的身份验证票证 通过设置 requireSSL="true" 元素。
限制表单身份验证 cookie 到 SSL 通道
在元素上设置 requireSSL="true"， 如以下代码所示。
通过设置 requireSSL="true"，您可以设置 安全 cookie 属性 确定浏览器是否应该 将 cookie 发送回服务器。 设置安全属性后， 浏览器仅将 cookie 发送到 使用请求的安全页面 HTTPS URL。
注意：如果您使用 cookieless 会话时，您必须确保 身份验证票永远不会 通过不安全的传输 频道。
Note: This is NOT an ASP.NET MVC question related to the [RequireSSL] attribute. Thats completely different - just has the same name.
ASP.NET Forms authentication has the RequireSSL property which requires that the auth cookie for ASP.NET membership is only ever sent over SSL. This is to prevent someone from stealing the cookie (such as by network sniffing) and impersonating the user.
So I'm wondering - with all the security conscious changes MS have made (such as making httpOnly cookies default) why is requireSSL not defaulted to true ?
Is cookie sniffing considered a 'neglibigle' security risk?
Is it considered an acceptable risk to leave it false unless the connection actually allows me to access secure/personal data? If it isnt acceptable - how am I supposed to return a user to http and still know who they are?
To prevent forms authentication
cookies from being captured and
tampered with while crossing the
network, ensure that you use SSL with
all pages that require authenticated
access and restrict forms
authentication tickets to SSL channels
by setting requireSSL="true" on the
element.To restrict forms authentication
cookies to SSL channelsSet requireSSL="true" on the element,
as shown in the following code.By setting requireSSL="true", you set
the secure cookie property that
determines whether browsers should
send the cookie back to the server.
With the secure property set, the
cookie is sent by the browser only to
a secure page that is requested using
an HTTPS URL.Note: If you are using cookieless
sessions, you must ensure that the
authentication ticket is never
transmitted across an unsecured
channel.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
因为如果您打开它，您需要 SSL 证书，而这些证书通常需要花钱才能获得。您还可以使用浏览器会话来控制非安全信息 - 在某些公共网站中，这可能正是您想要做的。在这种情况下，窃取他人会话 cookie 的人不会泄露任何敏感信息 - 那么为什么要花费成本和麻烦来购买和安装 SSL 证书呢？
Because you require an SSL certificate if you turn that on, and those usually cost money to acquire. You can also use browser sessions to control non-secure information - and in some public websites that may be exactly all you want to do. In that case nothing sensitive is revealed by someone stealing another person's session cookie - so why go to the cost and bother of buying and installing an SSL certificate?