Session Variables a threat?

•

What is DaniWeb IT Discussion Community?

You're currently browsing the VB.NET section within the Software Development category of DaniWeb, a massive community of 363,553 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 3,889 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.

Join our community!

Please support our VB.NET advertiser:

Thread Tools Display Modes

Views: 3633 | Replies: 3

•

Join Date: May 2005

Posts: 13

Reputation: earlofroberts is an unknown quantity at this point

Rep Power: 4

Solved Threads: 1

earlofroberts earlofroberts is offline

Offline

Newbie Poster

Session Variables a threat?

Jun 28th, 2005

I read that session variables in ASP were a security threat.
Is this true for session variables in .Net?

thanks,
ed

•

Join Date: Mar 2005

Posts: 65

Reputation: cpopham is an unknown quantity at this point

Rep Power: 4

Solved Threads: 0

cpopham

Offline

Junior Poster in Training

Re: Session Variables a threat?

Jun 28th, 2005

If someone can gain access to your computers memory where the session variables reside, you have a lot more to be concerned about than the session variables. Now in asp where you are going over the internet, I can see where this would be a concern.

Chester

•

Join Date: May 2005

Posts: 13

Reputation: earlofroberts is an unknown quantity at this point

Rep Power: 4

Solved Threads: 1

earlofroberts earlofroberts is offline

Offline

Newbie Poster

Re: Session Variables a threat?

Jun 29th, 2005

I guess the question is: do session variables in .Net reside on the server and not cross the net?

thanks,
ed

•

Join Date: Feb 2005

Posts: 175

Reputation: Letscode is an unknown quantity at this point

Rep Power: 4

Solved Threads: 5

Letscode

Offline

Junior Poster

Re: Session Variables a threat?

Jul 12th, 2005

Session variables run on the server side.Its not that easy to hack.You gotta hack the server to gain access to the session variables.

Most people say not to use session variables just because it degrades the efficiency of the webpage.

In my experience,session variables gave me a head ache in these cases.

1.In the middle of the application,if the user changes his screen resolution,the session variables remains the same(It screwed up).One has to close the browser and then reopen the browser for the application to run properly.

2.If you are using Dual servers and second server is intended to act when the first server fails.The session variables are lost when the first server fails.

Save White Tiger