Pages

Sunday, September 2, 2012

change session id after login asp

How to change session id after login asp


Risk of not changing session id after login asp 
on accessing the application the users receive a session id which remains constant until the browser instance is used closed. An adversary can hijack session and gain unauthorized access to sensitive information

Step to change session id after login in asp

<% dim ckie1,ckie2,findcolonpos,finalckie
   ckie = Request.ServerVariables("HTTP_COOKIE")
     findcolonpos=InStr(1,ckie,";")
   if findcolonpos>0 then
                ckie1=split(ckie,";")
                ckie2=split(ckie1(1),"=")
        finalckie=ckie2(0)
        else
                ckiename = Mid(ckie,1,(Instr(ckie,"=")-1))
                finalckie=ckiename
        end if

%>
<META HTTP-EQUIV="Set-Cookie" Content="<%=finalckie%>=NULL; path=/">


just put the above code  on top of page after the user gets login to application (eg :- Welcome page)



4 comments: