Asp.net session security

Question

If I put pretty important information in a session variable, how safe is it? Could this be accessed by a client who writes a rogue page and makes an ajax call for my application?

Thank.

Answer 1

If you really need to keep this data between requests, you must save it on the server side.

To store information for use between requests, you have the following options:

• Hidden fields: you should not use this to store confidential information, because the user (or the attacker) can get this information;
• ViewState: , , viewstate;
• Cookies: . , .
• : , , . - , .

, .

Answer 2

, , .

, . ajax ( ) . , .

, - , , ( ). . , HTTPS.

Answer 3

. , , , . , - , ... . . , , , . , . , , . , .

, . PCI: PCI

In addition, this session safe use guide can help: Fast, scalable, secure ASP.NET session