How secure are session variables?

[Giles]

Example:
session("IsLoggedIn")=false

Can this be changed on the user's machine by editing the cookie directly?
(Please tell me it can't!).
If so, will ASP know it has been tampered with, and refuse to "accept" it if
changed to "true" ?
Thanks
Giles

 

[Steven Burn]

Session cookies are stored in the servers memory, not on the client machine.

--
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[Bob Barrows [MVP]]

Example:
session("IsLoggedIn")=false

Can this be changed on the user's machine by editing the cookie
directly? (Please tell me it can't!).
If so, will ASP know it has been tampered with, and refuse to
"accept" it if changed to "true" ?
Thanks
Giles

Session variables are not stored on the client pc: they are stored in the
server's memory, which is one reason indiscriminate use of session variables
can impair performance.

The only thing stored on the client is a session cookie containing the
session id.

Bob Barrows