I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate.
Assuming that there is a webfarm of more than 1 web server behind a load balancer:
What threats would a stateless application have that a traditional "state aware" application don't have?
If there is a difference, what are the risks?
What should I do to my stateless MVC application to maintain comparable security? (I'm thinking about the options in a NetScaler with regard to session affinity)