ASP.net安全cookie的安全性如何

ASP.NET中的会话未经过身份验证 – 身份验证完全独立.通过获取会话cookie并重新创建它是的,您可以劫持会话,如果您取消身份验证cookie,那么您可以作为用户进行身份验证(这就是默认情况下身份验证cookie过期的原因) – 请参阅 http://msdn.microsoft.com/en-us/library/ms178581.aspx

安全说明很清楚;

SessionID values are sent in clear text,whether as a cookie or as part of the URL. A malicious user could get access to the session of another user by obtaining the SessionID value and including it in requests to the server. If you are storing sensitive information in session state,it is recommended that you use SSL to encrypt any communication between the browser and server that includes the SessionID value.