Asp.net - Using SSL to prevent cookie replay attack

I'm looking to put SSL into place to prevent cookie replay attacks on our site.

The site is using .NET forms authentication. Do I just need to en开发者_开发百科able SSL for the login page or would it be every page behind the forms authentication that needs to be secure?

THanks

You would need to enable SSL for every page where the browser is instructed to send the authentication ticket cookie. By default, that would mean every page on your website, although when writing the cookie to the browser you can instruct it to only send it over HTTPS or to limit it to certain paths.

But in general it would mean SSL protecting every page on your site, not just your sign in page.

.Net websites transfer non only the viewstate but any cookies back to the server on postback. This impacts your security in that someone using firesheep (or a similar tool) could easily pick up an authentication cookie, not on login, but when a user postsback via a button press, or ajax event several pages into the application.

If you have access to IIS you can not only enable SSL use, but force it.