Not really an ASP.NET specific question, but seems a good place to ask. In preparation for a business critical web application, I've been doing research into secure session management, in particular securely storing a session key as a cookie. The approach I intend to take is:
* Session key includes 256bit from cryptographic strength RNG
* Set cookie to "secure"
* Set cookie to "HttpOnly"
* Server forces HTTPS, with a valid SSL certificate
* Cookie to expire on browser shut down
* Cookie limited to exact domain
* Server checks session key against original IP address (controversial and potentially problematic, but I think it will work in our situation)
* No cross-site scripting (XSS) or user generated HTML/script in the entire application
This seems to me to be about as secure as you can get for browser based session management.
However I blathered fits and giggles when I realiz ...
Go to the complete details ...