I need help with securing cookies for my web application. It's deployed in IIS and is built in ASP.NET MVC. These are the things that I need to get more information about
- Is the Sites folder in IIS Manager also a virtual directory ?
If Sites is not a virtual directory then a. If website is deployed directly under Sites folder of IIS Manager, then is it really vulnerable for other insecure applications under the same Sites folder? OR b. will it be vulnerability only in case of virtual directories?
By default the path attribute of all cookies point out to root with '/' as its value. Does it point to the hierarchy level of web applications under Sites and will it affect other non secure applications? OR Does it point to just the web application for which the cookies were created?
After going through this article, I raised above questions. Just look for Path Attribute on the page.
If I really need to set the cookies path then there is one more thing, that they are being generated automatically with my web application such as session id, anti forgery token. So I can't set Path property on them since I am not creating them through HttpCookie object.
I am trying to gather as much clear explanations as possible by googling but it's difficult to get the flow clear.