防止用户 c# 更改“ASP.NET_SessionId”

Question

我试图阻止用户更改"ASP.NET_SessionId"

我试过这段代码：

Response.Cookies["ASP.NET_SessionId"].Value = GenerateHashKey();

但我的session (Session["userId"]) 在我尝试设置 cookie 时被删除了

这是我尝试没有成功的一些代码：

protected void Application_BeginRequest(object sender, EventArgs e)
{

    //Check If it is a new session or not , if not then do the further checks
    if (Request.Cookies["ASP.NET_SessionId"] != null && Request.Cookies["ASP.NET_SessionId"].Value != null)
    {
        string newSessionID = Request.Cookies["ASP.NET_SessionID"].Value;
        //Check the valid length of your Generated Session ID
        if (newSessionID.Length <= 24)
        {
            //Log the attack details here
            Response.StatusCode = 401;
        }

        //Genrate Hash key for this User,Browser and machine and match with the Entered NewSessionID
        if (GenerateHashKey() != newSessionID.Substring(24))
        {
            //Log the attack details here
            Response.StatusCode = 401;
            //throw new HttpException("401");
        }
        //Use the default one so application will work as usual//ASP.NET_SessionId
        Request.Cookies["ASP.NET_SessionId"].Value = Request.Cookies["ASP.NET_SessionId"].Value.Substring(0, 24);
    }
}

private string GenerateHashKey()
{
    StringBuilder myStr = new StringBuilder();
    myStr.Append(Request.Browser.Browser);
    myStr.Append(Request.Browser.Platform);
    myStr.Append(Request.Browser.MajorVersion);
    myStr.Append(Request.Browser.MinorVersion);
    SHA1 sha = new SHA1CryptoServiceProvider();
    byte[] hashdata = sha.ComputeHash(Encoding.UTF8.GetBytes(myStr.ToString()));
    return Convert.ToBase64String(hashdata);
}


protected void Application_EndRequest(object sender, EventArgs e)
{
    //Pass the custom Session ID to the browser.
    if (Response.Cookies["ASP.NET_SessionId"] != null)
    {
        Response.Cookies["ASP.NET_SessionId"].Value = Request.Cookies["ASP.NET_SessionId"].Value + GenerateHashKey();
    }

}

如何防止用户设置会话

Answer 1

您似乎正试图保护您的会话值不被篡改？如果您自己设置该值，则会覆盖会话标识符并破坏 asp 会话 cookie 的用途。

ASP.Net_SessionId 是一个cookie，用于识别服务器上的用户会话。会话是服务器上的一个区域，可用于在 http 请求之间存储数据。

如果你试图解决会话固定问题，这是asp会话cookie的唯一漏洞，那么你需要引入一个新的cookie，如下所示：https://medium.com/@grep_security/session-fixation-broken-authentication-and-session-management-c37ce0111bf5