2.4 Ensure 'forms authentication' is set to use cookies

Information

Forms Authentication can be configured to maintain the site visitor's session identifier in either a URI or cookie. It is recommended that Forms Authentication be set to use cookies.

Rationale:

Using cookies to manage session state may help mitigate the risk of session hi-jacking attempts by preventing ASP.NET from having to move session information to the URL. Moving session information identifiers into the URL may cause session IDs to show up in proxy logs, browsing history, and be accessible to client scripting via document.location.

Solution

Open IIS Manager and navigate to the level where Forms Authentication is enabled

In Features View, double-click Authentication

On the Authentication page, select Forms Authentication

In the Actions pane, click Edit

In the Cookie settings section, select Use cookies from the Mode dropdown

See Also

https://workbench.cisecurity.org/benchmarks/14293

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Windows

Control ID: 5901eb8800d592b5dc11c8451eb88610ee721f0997387aed8a730af661b8c566