Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

8.8. Session ID Denial-of-Service Attacks

The idea behind a session ID denial-of-service (DOS) attack is that a malicious user "poisons" session state by sending it numerous bogus session identifiers or by forcing the creation of sessions that will never be used after being initialized. Unlike other poisonings (for example, DNS cache poisoning) that involve placing incorrect or malicious data into a cache, session ID poisoning is very basic. A malicious user can spam the web server with session identifiers that are well formed but not associated with any active session. Hence, the term poisoning because the ASP.NET server ends up with an internal cache polluted with spurious session identifiers.

In a similar manner, a malicious user can access a page in an application that results in the issuance of a session identifier, but then throw away the cookie that is sent back by the application. In this manner, a malicious user can force an application to spin up a new session each time the page is accessed, again resulting in a session state store that is polluted with unused session state data.

A session identifier does take up a little bit of space and processing overhead on the web server each time a new session is started up. However, because ASP.NET has a number of internal optimizations around new and uninitialized sessions, sending a spurious identifier in and of itself is harmless. The real danger of session ID poisoning occurs if the session state object is accessed after the ...