How to Set secure attribute in cookie of MVC Application

itSDS · 2025-01-20 11:12:38

Hi Arnaud, we are asked to set secure Attribute for cookies, is this possible with m2 and how ?
ty

itSDS · 2025-01-20 11:55:16

One other question in this context, is it possible to crypt the traffic from client with syncrossplatform client to m2 server without using ssl.

as ssl can be compromitted with man in the middle attacks

ab · 2025-01-20 12:49:12

1) Please try
https://github.com/synopse/mORMot2/commit/f7137f47d

2) There is no such feature in the SynCrossPlatform client.
To mitigate MiM attack, you can force mutual authentication of both ends. This is the standard and proven way of fully securing a HTTPS link.

itSDS · 2025-01-20 13:57:35

Hi Arnaud, sounds good, is there an example of mutual Authentication available ?

ab · 2025-01-20 16:32:32

Not with the SynCrossPlatform client direct yet.
It depends on the HTTPS client unit used.

mORMot Open Source

#1 2025-01-20 11:12:38

How to Set secure attribute in cookie of MVC Application

#2 2025-01-20 11:55:16

Re: How to Set secure attribute in cookie of MVC Application

#3 2025-01-20 12:49:12

Re: How to Set secure attribute in cookie of MVC Application

#4 2025-01-20 13:57:35

Re: How to Set secure attribute in cookie of MVC Application

#5 2025-01-20 16:32:32

Re: How to Set secure attribute in cookie of MVC Application

Board footer