Forms Authentication - Weak Cookie Protection¶

Scope and impact¶

This setting belongs to ASP.NET Framework's System.Web forms authentication. Disabling ticket validation can allow unauthorized ticket changes; disabling encryption can expose ticket contents. A client-supplied role or authenticated=true cookie is not proof of identity.

Configuration example¶

These are alternative web.config fragments for an application already using Forms authentication. Keep the application's other settings.

Unsafe: remove cryptographic ticket protection.

<configuration>
  <system.web>
    <authentication mode="Forms">
      <forms protection="None" requireSSL="false" cookieless="UseCookies" />
    </authentication>
  </system.web>
</configuration>

Safer: retain validation and encryption, and require HTTPS.

<configuration>
  <system.web>
    <authentication mode="Forms">
      <forms protection="All" requireSSL="true" cookieless="UseCookies" />
    </authentication>
  </system.web>
</configuration>

All is the documented default. Review the patched runtime and machineKey configuration, including its algorithm policy: this switch alone does not select modern algorithms. Issue tickets through framework APIs only after successful authentication and required MFA. Microsoft's Forms protection reference describes the setting.

Verify the result¶

Using a disposable account over HTTPS, confirm a genuine ticket works and a modified ticket cannot authenticate. Check cookie flags in the browser, expiry, logout and all web-farm instances. A stolen valid ticket can still be replayed; encryption is not revocation. Continue checking authorization for the requested resource.

ASP.NET Core uses cookie authentication and Data Protection, not this System.Web setting. Plan migration with explicit key persistence, cookie policy and session invalidation. See cookie flags and session fixation.