I just began reading this book and is questioning the way security is handled in the first example (The online Diary and Organizer).
You just save the clear text DiaryID in a Session variable (Cookie).
Wouldn't it be extremely easy to modify the Cookie and now have access to areas you are not allowed into.
 Am I wrong here?

What is the best way to do this correctly

Hi there,

A Session variable is not the same as a cookie. A session variable lives *at the server*, but is identified with a cookie that lives *at the client*.

So, a session variable in clear text is only visible as clear text on the server, which makes it pretty difficult to hack.

Of course, replay attacks enable you to replay someone else's session, but that would equally apply to encrypted or hashed session variables.

So, generally, session variables are reasonably save.

Cheers,

Imar

---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004

I see - didn't know that. I thought session variables where similar to cookies.

They're related, but not the same. You can see session state as a big bag of stuff you can keep at the server. In this bag (stored in a server's memory or in a database) you can store stuff like simple strings to complex object types.

Each bag is identified by a unique ID (the Session ID). This ID is sent to the user and stored in a cookie (or in the querystring) to uniquely connect each bag of session variables to a user. With each request, the browser sends over the session ID from the cookie which ASP.NET then uses to find the right bag, containing the stuff that belongs to the current user.

Cheers,

Imar

---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004