Injecting security with session variables like it's insecure
I am doing web projects in dotnet. I am currently implementing security using session variables. I store the current user id and user type in the session and authenticate the user from these session variables (eg Session ["UserId"], Session ["UserName"] and Session ["UserType"]).
Please help me understand how this can be insecure. I have heard that this kind of protection can be breached and applications can be hacked very easily, for example one can get a session ID and directly connect to that session ID, etc.
Please help me with this.
a source to share
Under the hood, ASP.NET Forms Standard Authentication basically works the same way as you describe. The insecurity is mainly due to the fact that you are essentially telling ASP.NET "hey, don't worry ... I'll handle this." Keeping anxiety in mind, you unfold the rope with which you hang yourself (*). Microsoft has invested years of workforce in the ASP.NET framework and has some pretty solid security built in. You have to use it.
Aristos is barking the wrong tree ... if someone can steal "one plain cookie" from your user / site then they can also break the ASP.NET default security model. While this is definitely a concern, it is not really a problem.
* For example, let's say you create a "secure" page object called MySecurePage that always checks that the user is signed in and validated before executing code. Well, one day developer Joe comes along and forgets to use MySecurePage and uses the page instead. oops, you just destroyed all the security on this page. This is a simple example, but hopefully you get an idea of how many different ways you can do this.
a source to share