ASP.NET forms authentication using inadequate protection

Description

This web application is configured to use forms authentication but has the forms property protection set to a value that is not All (the default value is All). The All value is the recommended value for this property as this protection mode will both encrypt and validate the forms authentication cookie.

Remediation

It's recommended to set the <strong>forms</strong> property <strong>protection</strong> to <strong>All</strong>. <pre> &lt;authentication mode=&quot;Forms&quot;&gt; &lt;forms ... protection=&quot;All&quot; /&gt; &lt;/authentication&gt; </pre>

References

Related Vulnerabilities