Cookie eater... Problem with IE6 & ASP.

[Derick Bailey]

I have a development website running on Win2K Server, using ASP 3.0. I'm
using IE6 (all updates added).

I have a cookie that is set on a login page, which is an Encrypted password:
Response.Cookies("PWORD")=EncryptedPassword

I then redirect to a page:

Response.Redirect(GotoPage)

and on the page that is redirected, i look at the cookie:

Response.Write(Request.Cookies("PWORD"))

the problem is, when I do the request.cookies, it is NOT encrypted. The only
code that ever sets this cookie is the one line that I showed above, and one
line to set it to "" when the user hits the Logout button.

why is my cookie showing up unencrypted? and how do I fixe this? it seems to
be specific to my machine... but it just started happening last friday - and
i did not update anything, when this started happening. ... i was just
looking at pages on the site.

 

[Derick Bailey]

More Info:

When I do this:
Response.Write(Request.Servervariables("HTTP_COOKIE"))
the results show my cookie in the proper encrypted form.

 

[MSFT]

Hi Derick,

Is it possible for EncryptedPassword to return raw string without
Encryption? For example, there are some logical problem in the function? Is
there any some else code in your project which may change the cookie?
Additionally, if you clear the client cookie in IE and browse to the web
site again, will this fix the problem?

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Derick Bailey]

there is no logic used when reading the cookie, just
Request.Cookies("PWORD")

deleting the cookie from my hard drive fixed it.

thanks.

 

[MSFT]

I suspect "response.cookies("PWORD")" was written directly in your code
without Encryption. So the client cookie save on client disk without
Encryption. You may check your code to see if it is posible.

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)