ASP.NET: Failure To Require SSL For Authentication Cookies

Severity: Medium

Invicti detected that the ASP.NET has failed to require SSL for the authentication cookies.


When an ASP.NET application is failing to require SSL for the authentication cookies, then the cookie could potentially be stolen by an attacker who can successfully intercept the traffic, following a successful man-in-the-middle attack.

Actions To Take#

You can require the forms authentication cookie from your Web-based applications to use SSL by setting the requireSSL attribute of the forms element to true.

Vulnerable configuration:



<authentication mode="Forms">

<forms requireSSL="false">

Secure configuration:



<authentication mode="Forms">

<forms requireSSL="true">

Search Vulnerability

Build your resistance to threats. And save hundreds of hours each month.

Get a demo See how it works