使用会话变量有多安全？ ASP.NET C＃

Question

I have this code in my Login page:

        Session["user"] = user.Text;
        cmd.Parameters.AddWithValue("@user", Session["user"]);
        reader = cmd.ExecuteReader();

I saw this link how safe is it to use session variables - asp.net / c#

and I want to know if I need to change this type of login.

my question is if its safe to use session and if its possible to steal a session from another user and enter to the website as that user or something like that.

I tried to use membership but I couldn't change the register so I moved to Session.

Answer 1

Using session state to keep track of current login user is OK as long as you are on HTTPS . Session variables are stored in Server Memory (by default) .

We all used the similar approach in Classics ASP and ASP.Net 1.0 (before Membership in ASP.Net 2.0) .

The main drawback is the maintenance . It is hard to maintain when the application has too many pages and too many users with different authorizations.

Answer 2

As it has already been said, you should not have to worry about session security as long as you use https protocol and that your application server is safe.

But you should consider using Identity framework instead of the old Membership framework. Since 2013 Identity is the new authentication .NET standard, allowing SSO, role provider, claims based authentication etc...

See http://www.asp.net/identity/overview/getting-started/introduction-to-aspnet-identity to understand why you should choose identity over membership)