C# – Forms authentication login page issue

I've had similar concerns in connection to a request from one of our partners... ( See in details here: https://stackoverflow.com/questions/1367574/rewriting-urls-using-reverse-proxy )

As it turns out this "legitimate" process is actually using a hacking method called the "middle man". It technically pretends to be the user by keeping the cookie ID in its own session context while dealing with the server and keep a sparate one for the client computer.

So, in theory it could be done and it is a threat. Using SSL is the right way to go in my opinion if the data is in any way sensitive.

Funny enough in this Microsoft Support article http://support.microsoft.com/kb/910443 the phrasing makes you believe that it is actually the same for each request...

Forms authentication cookie is nothing but the container for forms authentication ticket. The ticket is passed as the value of the forms authentication cookie with each request and is used by forms authentication, on the server, to identify an authenticated user.

The cookie could be encrypted, using 3DES encryption. This could be enabled by setting the protection attribute to Validation of the authentication section of the web.config file. Using this setting the server verifies the data on the cookie for each transaction. This adds a little overhead though...

The first thing you need to do is to find a way to verify that your application was called from a trusted site. This means that the username must be encrypted before sending it. So both sites could share private key used to encrypt and decrypt sensitive information.

1. SiteA encrypts username using a key and sends it to SiteB (your site)
2. SiteB decrypts username using same key and retrieves user profile.