FEDAUTH 安全 Cookie

发布于 2024-10-14 04:38:24 字数 540 浏览 4 评论 0原文

我在使用 IE 7 浏览我的 asp.net 3.5 站点时捕获了“FEDAUTH”安全 cookie（使用 Fiddler），现在我知道 FEDAUTH 安全 cookie 标记有“HTTPOnly”标志，这意味着您无法从代码访问此 cookie 。堆栈中的所有 API 都遵循此标志，因此您无法通过代码获取 FEDAUTH 令牌。但.NET 包含一个 CookieContainer 类，它保存从 Web 请求发送和检索的 cookie 集合。因此，您所需要做的就是在调用之间传递 CookieContainer。

我的问题是有人可以获取这个 cookie 并在 http 请求中使用它，例如

CookieContainer cc = new CookieContainer();
                cc.SetCookies(new Uri(_uri), "FedAuth=77u/PD94bWwgdmVyhcmVwb2ludC5jb2addfdQ8UD4=; expires=Tue, 01-Jan-2010 02:37:12 GMT; path=/; HttpOnly");

原文

I have captured "FEDAUTH" security cookie (using Fiddler) while browsing my asp.net 3.5 site using IE 7 , Now I know that FEDAUTH security cookie is marked with a “HTTPOnly” flag, this means that you cannot access this cookie from code. All of the APIs in the stack honor this flag so you can’t get to the FEDAUTH token through code. But .NET includes a CookieContainer class that holds the collection of cookies sent and retrieved from a web request. So all you need to do is simply pass the CookieContainer along from call to call.

My question is can some one take this cookie and use it in a http request like

CookieContainer cc = new CookieContainer();
                cc.SetCookies(new Uri(_uri), "FedAuth=77u/PD94bWwgdmVyhcmVwb2ludC5jb2addfdQ8UD4=; expires=Tue, 01-Jan-2010 02:37:12 GMT; path=/; HttpOnly");

分享到QQ

分享到微博