I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET automatically stores all HttpSessionState objects, its attributes and any object they reference in memory. This implementation limits active session state to what can be accommodated by the system memory of a single machine.

In order to improve performance, it is recommended to mark all objects serializable to expand capacity.

While all steps have been taken to make all these objects Serializable, the fortify scanning tool still flags some string variable as vulnerable.

My question is: Are string variables not serialized by default? or I need explicitly mark these variables "Serializable"?

closed as off-topic by wireghoul, forest, Josef, Steffen Ullrich, NULLZ Jun 21 '18 at 4:02

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I think this is potentially a question better suited to a programmer? Whilst I understand you're doing a security audit the actual question: "Are string variables not serialized by default?" seems better on StackOverflow. – J.J Jun 19 '18 at 13:15