Secure cookies Asp.Net Core

Question

How to secure cookies in asp.net core. Because for now i have cookies in just plain text and everyone can get the data from inspector in browser. Does some handy solution exists for it, so it can encrypt and decrypt cookie value before processing?

context.Response.Cookies.Append("name", "Tom");

Don't store secrets or sensitive data on the client. End of story — Tseng
– Tseng, Commented Jun 6, 2018 at 14:38

Mohsen Esmailpour · Accepted Answer · 2018-06-06 13:31:36Z

4

There are several ways to encrypt and decrypt string and simple one of them is using IDataProtector.

private IDataProtector _protector;

public AccessController(IDataProtectionProvider provider)
{
    _protector = provider.CreateProtector("MySecretKey");
}

public void ActionResult Index()
{
    var protectedName = _protector.Protect("Tom");

    HttpContext.Response.Cookies.Append("name", protectedName);
   .
   . 
   .
}

and use _protector.UnProtect(encryptedString) to decrypt string.

answered Jun 6, 2018 at 13:31

Mohsen Esmailpour

11.6k3 gold badges49 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Sha Over a year ago

Won't this will fail if you are using a server farm or if the site is moved to a different server? I.e. you won't be able to read the value of the cookie if site is relocated.

pim Over a year ago

@Sha this is true. But avoidable. You just need to specify a shared key-ring: learn.microsoft.com/en-us/aspnet/core/security/…

Sha Over a year ago

@pimbrouwers - Yeah, I just want to avoid all that complexity.

Collectives™ on Stack Overflow

Secure cookies Asp.Net Core

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related