Better session security? about session

[Tratcher]

@blowdart?

[blowdart]

I am about to hop on a plane, and will be slow to respond all week.

So, quickly

1. We don't support session ID in URLs any more. So the session fixation problem goes away.
2. As noted auth is separate to session
3. Protecting against XSS is the app's concern, but, with MVC we encode everything by default. So, setting the cookie via XSS is unlikely, unless the developer has bypassed all our protection, at which point there's no helping them.
4. Man in the middle attacks - use HTTPS

If you want Andre's protection then by all means add his package, but I don't see the need to implement that sort of approach ourselves.

[muratg]

Closing based on @blowdart's comment. @alexdresko, please let us know if you have other questions.