title: Form Authentication - Cookie replay attack - protection
body: <p>I am being asked about cookie replay attacks with my ASP.NET websites forms authentication.</p>
  
  <p>I have followed the advice below to protect against any attack but think that the site is still vulnerable if somebody manages to get at the cookie (albeit only for a short time). Is there a way to completely destroy the forms authentication session on logout so that even if someone had stolen the cookie there would be no chance of using it maliciously</p>
  
  <p>Advice followed was</p>
  
  <p>We believe we have taken all responsible steps we can to protect against this within the confines of ASP.NET. Please see detailed response below.</p>
  
  <p>However we have implemented the recommended steps from Microsoft to defend against this (see <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;900111">http://support.microsoft.com/default.aspx?scid=kb;en-us;900111</a>)</p>
  
  <p>·         The authentication cookie is never written to a client machine making it hard to steal.</p>
  
  <p>·         The application is run-able via SSL so a cookie is never issued over a non secure connection</p>
  
  <p>·         We enforce absolute expiration with a 15 minute timeout meaning that any issues cookie is useless after that time limit</p>
  
  <p>·         We use httpOnly cookies so that no-one can pro grammatically intercept or alter this cookie.</p>
  
  <p>So even if the above precautions were broken, which we think highly unlikely, a malicious user would only have 15 minute window to break the precautions and successfully log in  </p>