Most of the sites today (including asp.net) run on http, using https only for the logon process. During login, the username/password are securely transferred across web using https, and appropriate authetication cookies are sent to the client.
Now my question is, after I have logged-in to a site, it is just the cookies that identify me to the server during subsequent requests. If a hacker is eaves-dropping on my line, after I log in, can't he hijack my cookies, build requests to the server using my cookies, and thus successfully impersonates to the server as me??
Is there any built-in security check against these kind of identity hijacks in asp.net??
I wonder, even such a security check is possible. Basically, you need to identify from the cookie that the client actually is what he/she is claiming to be. After the logon process, in my opinion, all that you can check is the IP to make sure that the requests are coming from the same IP from which the user logged ...
Go to the complete details ...