ASP session variable security question

[Spork52]

I was told by an MS engineer that every time the browser connects to the server the session variables are sent to the server from the browser (well, actually references to the session variables) and that the way to prevent session hijacking is to force an SSL connection at all times.

So, I am using this code from MS to force SSL connections:

If Request.ServerVariables("SERVER_PORT") = 80 Then
	Dim strSecureURL
	strSecureURL = "[URL unfurl="true"]https://"[/URL]
	strSecureURL = strSecureURL & Request.ServerVariables("SERVER_NAME")
	strSecureURL = strSecureURL & Request.ServerVariables("URL")
	Response.Redirect strSecureURL
End If
'Assumes the following conditions:
'- IIS is running on standard ports:
'- HTTP = Port 80
'- HTTPS = Port 443
'- IIS has a valid SSL certificate installed.
'- The Web site or virtual server that is used does not use HTTP/1.1 host headers for name resolution.

But it seems to me that this might still be insecure since the browser first makes a non-SSL connection to the server before it's redirected to make an SSL connection.

Am I correct?

When do the session variables actually get sent?

 

[DreXor]

basically you have it about as secure as i can think of with the exception of whereever this link is coming from say an email to make sure it's https there before hand.

DreX
aKa - Robert
if all else fails, light it on fire and do the happy dance!
" I always think outside the 'box', because I'm never in the 'loop' " - DreX 2005

 

[DreXor]

come to think of it in IIS remembered you can force SSL..

http://support.microsoft.com/kb/239875

http://forums.iis.net/t/774591.aspx

http://www.geekvue.com/2009/01/13/how-to-force-redirection-from-http-to-https-on-iis-60/

DreX
aKa - Robert
if all else fails, light it on fire and do the happy dance!
" I always think outside the 'box', because I'm never in the 'loop' " - DreX 2005

 

[DreXor]

the last one being your most likely candidate, you're already doing the MS KB recommened.

DreX
aKa - Robert
if all else fails, light it on fire and do the happy dance!
" I always think outside the 'box', because I'm never in the 'loop' " - DreX 2005