Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in plain text? Will someone sniffing the network traffic be able to hijack an authenticated session?

share|improve this question

NTLM is probably one of the better options you've got in terms of authenticating in the clear, but you still have plenty of vulnerability if you aren't encrypting the transport layer, even in a somewhat trusted environment. Basically, if the data matters spend the extra $25 and get yourself a legit certificate.

share|improve this answer
Thanks for the reply Wyatt. I have... a lot to learn about security, and most of my research seems to apply to with forms based security. I'd like to know, specifically, if the "Authorization:Negotiate" cookie that is used with Integrated Windows Authentication is vulnerable in the same way that the Session Id is (when sent over http). Most security warnings are concerned over a visible Session Id. If I'm not using ASP.Net sessions, and hence have no session Id,does the Authorization:Negotiate cookie present the same vulnerability? – jlnorsworthy May 28 '13 at 23:33
that would be a good question to ask at . It still doesn't cover the underlying issue that if someone is in place to hijack the session they can hijack the data. And if they can hijack -- and likely do significantly worse -- with the data all your authentication is pretty immaterial. – Wyatt Barnett May 29 '13 at 0:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.