I'm into extend a authenticating service and like to ask about the security perspective of HttpContext.Current. Let say you have a authentication serve websites / wcf and such (where http is applicable). HttpContext.Current are used to store the session and other info in the Items array, no need passing credentials around throughout the session.
How safe are HttpContext and can it be misused and exploit security flaws? There are a a lot of posts and blogs that talk about "don't put session or System.Web into your business layers". Some just state "don't let the user know about your business layer". What would the user know and where are the border for a "business layer"? I.e. a business layer is solely a ground for web sites.
Where are the danger those folks predicate for and what can be done by a user that want to break the authentication? Are there "too easy" to develope bugs that make the system behave unexpected or give more access then mentioned?