ASP.NET 中的会话劫持保护
我想了解当前版本的 ASP.NET 中内置了哪些会话 ID 劫持保护。
我最近看到这篇信息非常丰富的文章，它解释了如何增强会话安全性通过实现一个附加层，将 IP 地址和用户代理标头编码到会话 ID 中。然后，这些详细信息将在每个后续请求中进行验证。
这篇文章似乎是为 ASP.NET 1.1 编写的，所以我想知道 ASP.NET 中现在是否内置了类似的内容。实施这样一个附加层还有什么好处吗？
谢谢。
I'd like to find out what session ID hijacking protection is built into the current version of ASP.NET.
I recently saw this very informative article that explains how session security can be enhanced by implementing an additional layer that encodes the IP address and user agent header into the session id. These details are then verified on each subsequent request.
It seems that this article was written for ASP.NET 1.1 so I'd like to know if anything similar is now built into ASP.NET. Is it still of any benefit to implement such an additional layer?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
查看会话概述文档中的这段代码：
System.Web.SessionState.HttpSessionState.SessionID 值以明文形式发送，无论是作为 cookie 还是作为 URL 的一部分。恶意用户可以通过获取 SessionID 值并将其包含在对服务器的请求中来访问其他用户的会话。如果您在会话状态中存储敏感信息，建议您使用 SSL 来加密浏览器和服务器之间包含 SessionID 值的任何通信。
http://msdn.microsoft.com/en-us/library/ms178581.aspx
在我看来，这意味着 Session 中没有内置安全性，因此您可能不应该使用 Session 作为安全措施。相反，我建议依赖 ASP.NET 安全性（身份验证、授权）。
这是来自 Patterns & 的一篇文章。针对 ASP.NET 的一般安全建议的实践小组。
http://msdn.microsoft.com/en-us/library/ff649100.aspx
Check out this snippet from the Session Overview documentation:
System.Web.SessionState.HttpSessionState.SessionID values are sent in clear text, whether as a cookie or as part of the URL. A malicious user could get access to the session of another user by obtaining the SessionID value and including it in requests to the server. If you are storing sensitive information in session state, it is recommended that you use SSL to encrypt any communication between the browser and server that includes the SessionID value.
http://msdn.microsoft.com/en-us/library/ms178581.aspx
It seems to me that this means that there is no security baked into Session, so you probably shouldn't use Session as a security measure. Instead, I would recommend relying on ASP.NET security (authentication, authorization).
Here is an article from the Patterns & Practices group on general security recommendations for ASP.NET.
http://msdn.microsoft.com/en-us/library/ff649100.aspx
嘿，我也一直在寻找降低会话 ID 劫持风险的方法。我还阅读了 Jeff Prosise 的文章，我认为它可能有用；然而，就像你一样，我想看看同样的方法是否适用于框架的现代版本（他的电子邮件 [电子邮件受保护] 不起作用顺便说一句）
jkohlhepp，我不同意你的帖子（或者也许我不明白）：
就我而言，asp.net 身份验证依赖于会话 ID（除了 cookieless，这似乎更糟糕： 查看 Dino Esposito 的意见）
所以，这几乎让我们回到了起点。
Hey, I have also been looking for ways to reduce the risk of session ID hijacking. I read Jeff Prosise's article as well and I thought it could be useful; however, just like you, I was looking to see if the same approach applies for modern versions of the framework (his email [email protected] doesn't work btw)
jkohlhepp, I don't agree with your post (or maybe I don't understand it):
As far as I'm concern asp.net authentication relies on Session IDs (except cookieless which seems to be worse: See Dino Esposito's opinion)
So, that pretty much put us where we started.