Author: andieje | Posted on: 11/16/2009 12:05:50 PM | Views : 426

Hello
It is my understanding that in asp.net the forms authentication ticket is hashed and to create a HMAC and then encrypted using AES.
I believe that ticket is hashed to ensure it has not been tampered with but why do you need the hashing at all? The fact the the ticket is encrypted is sufficient to stop the message from being tampered with isnt it? If you don't have the server's private key to encrypt your false data it will be rejected at the server because it will fail the decryption process. So you can assume that if you have been able to decrypt the data it has not been tampered with?
 
thanks
...

Go to the complete details ...