I have a website project with .NET 6 (MVC) and I use an authentication cookie for authorizing users with this config:
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie(options =>
{
options.SlidingExpiration = true;
options.Cookie.HttpOnly = true;
options.Cookie.SameSite = SameSiteMode.Lax;
options.Cookie.Name = "sepsep";
options.Cookie.IsEssential = true;
options.ExpireTimeSpan=TimeSpan.FromDays(365);
});
I've created the same cookie (name, value and etc) on another browser on another computer and I am authorized now on that other computer!
Is it possible to protect this cookie so it won't be copied? I mean I think this cookie should just work in my own computer and even just in that browser!
UPDATE
I use claim based method to login the user:
var claims = new List<Claim>
{
new Claim("UserMobile",mobile),
};
var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
var authProperties = new AuthenticationProperties
{
IsPersistent = true
};
_contextAccessor.HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(claimsIdentity),
authProperties);