How to overcome Session Hijacking

Question

5.00/5 (1 vote)

See more:

Hi,

I am using session for my pre and post login like below,

C#

// Login Page Code..

protected void page_onload(object sender, eventargs e)
{
   if(string.IsNullOrEmpty(Convert.Tostring(session["LoginId"])))
        session["LoginId"] = "Guest";
}


protected void page_btnLogin_Click(object sender, eventargs e)
{
   session["LoginId"] = "SomeUserId";
   response.redirect("PostloginPageURL");
}

// Post login Page Code..

protected void page_onload(object sender, eventargs e)
{
   if(!string.Equals(Convert.Tostring(session["LoginId"]),"SomeUserId"))
       response.redirect("loginPageURL");
   else
      //Fetch some code...
}

Above if you see, i am using same session to manage both my pre and post login. This may lead to session hijacking by using the session id.

So after a long time search i came to a conclution that one need to change the sessionId, because both pre and post login session has same sessionid.

Again doing some search i got the code of creating new sessionid as below

C#

protected void page_btnLogin_Click(object sender, eventargs e)
{
   session.Abandon();
   Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
   session["LoginId"] = "SomeUserId";
}

Above code is successful in generating new sessionid.
But i am unable to retrieve my saved value. i.e I am unable to get value of session on the other page.

I tried
all below:

Removed session.Abandon(); and checked ---> FAILED
Tried response.redirect("MyUrl",false) ---> FAILED
Tried Server.transfer("MyUrl") ---> FAILED

Valid answers are appreciated.

Thank you.

Posted 15-Sep-11 0:18am

Muthu Nadar

Add a Solution

Comments

Sazzad Hossain 7-Oct-11 6:09am

could u pls explain why would u keep current user id in session? If you do forms authenticaion then the HttpContext.User will hold the user id anyway. That way would will not have to care with current session. When anyone signs out, u can just call Session.Clear..

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Munim Abdul · Answer 1 · 2011-09-15T22:54:00

This will regenerate your session ID and keeping the session data intact :) Try it out!

C#

void RegenerateId()
{
    var manager = new SessionIDManager();
    string oldId = manager.GetSessionID(Context);
    string newId = manager.CreateSessionID(Context);
    bool isAdd, isRedir;
    manager.SaveSessionID(Context, newId, out isRedir, out isAdd);
    var ctx = HttpContext.Current.ApplicationInstance;
    HttpModuleCollection mods = ctx.Modules;
    var ssm = (SessionStateModule)mods.Get("Session");
    var fields = ssm.GetType().GetFields(BindingFlags.NonPublic | BindingFlags.Instance);
    SessionStateStoreProviderBase store = null;
    FieldInfo rqIdField = null;
    FieldInfo rqLockIdField = null;
    FieldInfo rqStateNotFoundField = null;
    foreach (var field in fields)
    {
        if (field.Name.Equals("_store")) store = (SessionStateStoreProviderBase)field.GetValue(ssm);
        if (field.Name.Equals("_rqId")) rqIdField = field;
        if (field.Name.Equals("_rqLockId")) rqLockIdField = field;
        if (field.Name.Equals("_rqSessionStateNotFound")) rqStateNotFoundField = field;
    }
    object lockId = rqLockIdField.GetValue(ssm);
    if ((lockId != null) && (oldId != null)) store.ReleaseItemExclusive(Context, oldId, lockId);
    rqStateNotFoundField.SetValue(ssm, true);
    rqIdField.SetValue(ssm, newId);
}

Md. Rashim Uddin · Answer 2 · 2011-09-15T00:29:00

Solution 1

Please have a look on that [^]

Posted 15-Sep-11 0:29am

Md. Rashim Uddin

Updated 15-Sep-11 0:59am

v2

Comments

Muthu Nadar 15-Sep-11 9:08am

Thank you for putting your valuable time in helping me...

I successfully change the session id. But what i need is, after changing the session id i am setting value to that session. While setting it get set. But when i postback the page the session value is lost.

Muralikrishna8811 · Answer 3 · 2011-09-15T00:47:00

Solution 2

Hi
You are using some wrong code

upto my knowledge you cannot do both abandon and invoke session variables in same request.b'coz the request is processed based on sessionID i hope you know this .thats y we cannot access that session variable in after dat request eventhough we assign in dat same request

but you can do in different requests like

first abandon the session in one page then redirect to another page
in that page you can invoke your session with another sessionID for post login users

Posted 15-Sep-11 0:47am

Muralikrishna8811

Updated 15-Sep-11 0:49am

v2

Comments

Muthu Nadar 15-Sep-11 9:10am

Thank you for putting your valuable time in helping me...

You are right with the concept.

But is there any way on managing the things.
Can u help me out by giving some tips on how can i overcome Session Hijacking.

Muthu Nadar 15-Sep-11 9:20am

You must have seen the things which i tried.
I also removed the session.abandon() and i just changed the session id. Then also the value in the session is not saved.

How to overcome Session Hijacking

3 solutions

Solution 3

Solution 1

Solution 2

Add your solution here

Preview 0

Existing Members

...or Join us