Let's talk about network security and session impersonation and cookie tamper-proofing.

Websites are inevitably faced with security issues, such as SQL Injection pulling, Cookie impersonation, etc. SQL injection is a commonplace, and there are many excellent posts explaining this problem, so let's talk about the risks and Countermeasures of session impersonation.
First, let's talk about the principle of the session. Session is a mechanism for maintaining sessions on the server. In fact, session is not specified in the HTTP protocol, so its implementation method is a bit strange, different web frameworks have different implementation mechanisms for sessions. However, the principle is similar. Here, the common application mechanism is to store a session ticket (that is, sessionid) through cookies ), after the server obtains the sessionid in the cookie, it stores the session data in the backend (which can be a process, database, or any other things that can store data, including files.
We can use a packet capture tool to obtain a piece of data, as shown below:
GET/W3/global/J/global. js HTTP/1.1
Accept :*/*
Referer: http://www.jiayuan.com/login/index.php? Pre_url =/usercp
Accept-language: ZH-CN
Accept-encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; sv1; embeddedwb 14.52 from: http://www.bsalsa.com/embeddedwb 14.52)
HOST: images.jiayuan.com
Connection: keep-alive
COOKIE: session_hash = large; stadate1 = 25727411; myloc = 53% 7c5301; myage = 24; mysex = m; myuid = 25727411; myincome = 30; last_login_time = 1277561249; new_msg = 0; pop_1268278480 = 1277575662747; pop_time = 1277561290653

Sessionid is the red text. Of course, ASP. NET has a cookieless mechanism to put this ID in the URL for transmission.
There is a problem here. This ID is submitted in plain text in a non-SSL environment, so if this ID is stolen, you can impersonate someone else's identity (note: in most frameworks, once a session is created, the sessionid value is fixed and will not change ).
This involves a statement in web development, that is, any input on the client is untrusted. Therefore, as the cookie is the data retained on the client, without the protection of the tamper-Proofing Mechanism, its content is also untrusted. Once such data is trusted, there will be a security risk.
So how to prevent it? Here we need to implement the cookie tamper-proofing function. The anti-tampering mechanism of cookies is simple. Suppose I have a value to write a cookie
Key = "user_name" value = "Alexander"
It is impossible to prevent this value from being tampered with into another value, because the cookie has been written to the client, and others can modify it at will, so the server cannot block it, however, we can use a tamper-Proofing Mechanism to let the server know that the cookie value has been tampered. Therefore, when sending a cookie to the client, it cannot be sent back as it is. We keep up with a tamper-resistant verification string after the cookie value, and send it to the client as a whole. Therefore, the Cookie obtained by the client may look like this:
User_name = Alexander | ab95ef23cc6daecc475de
Use | the verification string is followed by the anti-tampering verification string. It is generated in this way, des (cookie content + salt value)
You can also use MD5 (cookie content + key) or sha1 (cookie content + key). The key here is only known to the site itself. If it is leaked, it will be doomed. After the server receives the cookie, it can use the cookie content + key to re-calculate the verification string and compare it with the submitted one. If it is consistent, we believe that the cookie has not been tampered with. On the contrary, the cookie must have been tampered with, so we do not trust this submission. If all cookies are tamper-resistant, you don't have to worry about the occurrence of sessionid impersonation.
ASP. net sessionid I don't know if there is this mechanism (shame, I have never been concerned about it before) But Cookie does not exist, so you can add this function by yourself, this will be of great help to improve the security of the site.