Tag Info

New answers tagged

0

Adding ASP.NET Identity should not be that big of a job. Guide here. Session has not been designed as an authorisation mechanism. It has some characteristics that make it unsuitable such as using the same identifier pre and post authentication, making it vulnerable to session fixation. Also, it is difficult to check authorisation status for page access, as ...


1

Since both implementations rely on the security of the cookie to protect the session, that means the comparison mostly relies on the qualities of the cookie values (meaning if you steal either cookie you're in). Both values are basically a value encrypted against a key stored server-side. Sessions uses a random value encrypted against the machine key, and ...



Top 50 recent answers are included