Return to HomePage

---

Does the code persist role manager cookies?

Applies To

* ASP.NET 2.0

Description

Make sure that the roles cookie is not stored on the client by setting the createPersistentCookie attribute to false.

The code should not persist role manager cookies because they are stored in the user's profile and can be stolen if an attacker gains physical access to the user's computer. Role manager cookies can reveal sensitive information about your application's role structure that an attacker can exploit.

The application should not contain code similar to the following example.

		 <system.web>
		  <roleManager createPersistentCookie="true" ... />
		 </system.web>
	

Instead, the application should contain code similar to the following.

		 <system.web>
		  <roleManager createPersistentCookie="false" ... />
		 </system.web>
	

Additional Resources

* For more information see, "How To: Use Role Manager in ASP.NET 2.0" at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGHT000013.asp

Related Items

---

Return to HomePage