how secure are Session(" ") ?

[Gurra]

Hi ive seen alot of communites that use the session("") cookie to assaign
the userid after the login
Since this is a cookie, isnt it easy to modifie it and become which user you
want at the current community ?

 

[Curt_C [MVP]]

nope... unless you write it to the users drive (by setting a .Expires) it's
in memory..
Not easy to "hack"....

 

[Ken Schaefer]

An ASP Session cookie only contains the ASPSessionID. The server keeps all
the data in the server's memory. The browser returns the ASPSessionID, and
the server uses that to lookup the user's data.

So, it's not "hackable" in the sense that the data isn't stored anywhere on
the client's machine, or transmitted between the client and the server.
However, if someone could guess your ASPSessionID (either by luck, or by
sniffing traffic between you and the server), then they could launch a
session-hijacking type attack.

Cheers
Ken

: Hi ive seen alot of communites that use the session("") cookie to assaign
: the userid after the login
: Since this is a cookie, isnt it easy to modifie it and become which user
you
: want at the current community ?
:
: