how safe is it to use session variables – asp.net / c#

by

Session state is kept entirely server-side, no matter which storage method you use (in-memory, session state server or database).

So unless your server is hacked, Session variables are safe. And in case your server does get hacked, the hacker would only have access to the data in his own session, unless he finds a way to analyze the IIS process’ memory.

More Related Contents:

  1. Session Variable with if/else statement in Views?
  2. Keeping ASP.NET Session Open / Alive
  3. Web app blocked while processing another web app on sharing same session
  4. How to set session timeout in web.config
  5. Advantages of Cache vs Session
  6. Access HttpContext.Current from different threads
  7. HttpContext.Current.Session is null in Ashx file
  8. What is the best way to determine a session variable is null or empty in C#?
  9. How to delete cookies on an ASP.NET website
  10. How to Kill A Session or Session ID (ASP.NET/C#)
  11. How to share sessions between PHP and ASP.net application?
  12. What is the difference between a Session and a Cookie in ASP.net?
  13. Unable to serialize the session state
  14. C# Clear Session
  15. Can OWIN middleware use the http session?
  16. ‘Session’ does not exist in the current context
  17. converting a base 64 string to an image and saving it
  18. Using static variables instead of Application state in ASP.NET
  19. Why AppDomain.CurrentDomain.BaseDirectory not contains “bin” in asp.net app?
  20. Pattern for calling WCF service using async/await
  21. Get text/value from textbox after value/text changed server side
  22. Asp.net core Identity successful login redirecting back to login page
  23. Stop SQL query execution from .net Code
  24. Persist FileUpload Control Value
  25. Decoding all HTML Entities
  26. Datatable to html Table
  27. Mobile Device Detection in asp.net
  28. The entity type ApplicationUser is not part of the model for the current context
  29. Encrypting Web.Config
  30. IIS Request.UserHostAddress returning IPV6 (::1), even when IPV6 disabled

Leave a Comment