Is Session state secure ?

[WJ]

I have forms that are protected by Form Authentication. These forms seem to
access (read) session variables OK, however, forms that are not protected by
"authhenticated ticket" cannot read the session variable. Is it true ?

1. My session variables are stored in SQL/Server.

2. External web site calls one of my unprotected forms (non-interative), in
this form, I need to read certain session variables in order to move on. But
it complains that invalid pointer was referenced.

Thanks for your help,

John