Geek asks and answers

Secure authentication of forms behind a proxy server

We use Stunnel (to disable SSL) and HAProxy on our load balancer, which then sends IIS requests via HTTP.

The problem is that we want our sites (ASP.NET) to set cookies in safe mode, that is, set the requireSSL attribute to true.

When we set this attribute and make an HTTPS request to the site, we get this error:

The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL.

Can I trust a web server if the request comes through SSL from load balancing? Or is this not a problem, since ONLY access to our site via SSL (only 443 is open)?

+3
source share
2 answers

Instead of this:

FormsAuthentication.SetAuthCookie(email, false);

try the following:

var cookie = FormsAuthentication.GetAuthCookie(email, false);
cookie.Secure = true;
HttpContext.Current.Response.Cookies.Add(cookie);

ASP.NET MVC, , cookie

+2

ASP.NET MVC 3, , , , - : -

namespace MyNamespace
{
    public class SecureCookiesAttribute : FilterAttribute, IResultFilter
    {
        public void OnResultExecuting(ResultExecutingContext filterContext)
        {
            foreach (string cookieName in filterContext.HttpContext.Response.Cookies.AllKeys)
                filterContext.HttpContext.Response.Cookies[cookieName].HttpOnly = true;

            if (filterContext.HttpContext.Request.IsLocal)
                return;

            foreach (string cookieName in filterContext.HttpContext.Response.Cookies.AllKeys)
                filterContext.HttpContext.Response.Cookies[cookieName].Secure = true;
        }

        public void OnResultExecuted(ResultExecutedContext filterContext) { }
    }
}

HTTPOnly cookie , , , . HTTP, HTTPS ( , , , HTTPS).

+2

More articles:


All Articles