Reason to rename ASP.NET Session Cookie Name?

后端 未结 6 1728
抹茶落季
抹茶落季 2021-01-11 15:33

is there any reason (safety?) why someone should rename the ASP.NET Session Cookie Name or is it just a senseless option of ASP.NET?

6条回答
  •  自闭症患者
    2021-01-11 15:58

    Below link provides more information about why session cookies should be renamed.

    https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

    "The name used by the session ID should not be extremely descriptive nor offer unnecessary details about the purpose and meaning of the ID.

    The session ID names used by the most common web application development frameworks can be easily fingerprinted [0], such as PHPSESSID (PHP), JSESSIONID (J2EE), CFID & CFTOKEN (ColdFusion), ASP.NET_SessionId (ASP .NET), etc. Therefore, the session ID name can disclose the technologies and programming languages used by the web application.

    It is recommended to change the default session ID name of the web development framework to a generic name, such as “id”."

提交回复
热议问题