title: ASP.NET Forms Authentication and Persistent Authentication Cookie Security
body: <p>When we are using ASP.NET Forms Authentication in any of ASP.NET frameworks (ASP.NET MVC, Web Forms, etc.), we persist the authentication cookie in client's browser. As a best practice, we set the cookie as HttpOnly and secure. We also make all transactions over SSL. No matter what kind of mechanism we use to authenticate the user (OAuth, ASP.NET Membership Provider, etc), we still need to persist the authentication for better user experience.</p>
  
  <p>With all those in place, I am assuming that someone can still get the cookie out of the client browser and issue requests with those auth cookie values. This cannot be detected by the server and we would be giving protected data to someone else.</p>
  
  <p>One think I have in mind to lower the risk here is to ask client's password everytime when s/he tries to take some serious actions (such as changing the e-mail address, accessing profile info, etc.) but this doesn't solve anything and can be pretty annoying for the client.</p>
  
  <p>Do you have any approach that you are actively following for this kind of issues? Or what would be the best possible way to persist the authentication in clients browser?</p>