SharePoint 2010 Persistent Cookies Contents

Question

Does SharePoint 2010 keep passwords in cookies (in any form hash/encrypted)? I don't think so as long as the authentication mode is Windows, am I right in thinking that?

I have already read the persisten cookie white paper at http://www.microsoft.com/en-us/download/details.aspx?id=30447 so please do not redirect me there. It has a section for authentication cookie but that also doesn't suggest that is keeps password somewhere.

I would be amazed if SharePoint (after all a web site so on client side just HTML) has the capability to get the password from domain-controller or some local store in an encrypted way then keep it in some cookie?

If it doesn't keep the password then how does it lets Office Applications open and edit documents?

I am really confused :-?

Answer 1

Sharepoint does not store passwords. It uses different HttpModules to authenticate you (such as the Windows Auth Module).

Also, remember that Sharepoint is built on top of ASP.Net, so it uses the .Net authentication mechanisms.

Let me try to explain the concept of authentication in ASP.Net

1. Client makes a request to the server.
2. Server replies back to the client on which authentication mehotds are supported.
3. Client sends through authentication (normally NTLM).
4. Server receives credentials and if NTLM, it contacts Active Directory and authenticates you.
5. Server replies saying you are authenticated. Server also adds the persisted authentication cookie to your browser so that it does not have to query active directory everytime you make a request.

Read more about the subject here: http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx