4 ms·
This looks pretty bad. The standard way to authenticate in an asp.net app, FormsAuthentication.RedirectFromLoginPage(), basically encrypts a username and saves
by redstripe 16y ago
This looks pretty bad. The standard way to authenticate in an asp.net app, FormsAuthentication.RedirectFromLoginPage(), basically encrypts a username and saves it to a cookie.
Any subsequent requests to a site will trust that cookie as long as it decrypts properly.
- brl 16y agoYes, exactly. Among other things, this attack allows you to forge authentication cookies on any ASP.NET application with a 100% success rate.