DerScanner
Home / Vulnerability Database / C-sharp : Persistent authentication
C#

C-sharp : Persistent authentication

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Top 10 2017
A2-Broken Authentication
OWASP Top 10 2021
A7-Identification and Authentication Failures
OWASP ASVS
Session ManagementAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthentication
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (a)(2)(iii)
CWE
CWE-1028

Overview

Than application uses a persistent authentication ticket, which increases the risk of session hijacking.

FormsAuthentication.RedirectFromLoginPage() method generates an authentication token. If called with the second argument being true, the token is persistent.

References

  1. FormsAuthentication.RedirectFromLoginPage Method - msdn.microsoft.com
  2. OWASP Top 10 2017 A2-Broken Authentication
  3. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix C-sharp : Persistent authentication in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined