NWebsec - Improved session security for ASP.NET Classic

The NWebsec.SessionSecurity library improves ASP.NET session security by enforcing a strong binding between an authenticated user’s identity and the user’s session identifier.

You’ll find the library on NuGet: NWebsec.SessionSecurity. You can also get it under Releases over at GitHub.

To learn more about how it works, see Authenticated session identifiers. To see how it’s configured, refer to Configuring session security.

For background on why the library improves security, see the blog post Ramping up ASP.NET session security.

Did you now that the SDL requires countermeasures against session fixation attacks, and that certain security headers must set by your web application? No? See NWebsec and the SDL to learn more.

To keep up with new releases or to give feedback, find @NWebsec on X.

Looking for the other NWebsec docs?

This documentation covers NWebsec.SessionSecurity. For the other NWebsec packages, see the main NWebsec documentation.