I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory. By default, the framework .NET automatically stores all HttpSessionState objects, its attributes and any object they reference in memory. This implementation limits active session state to what can be accommodated by the system memory of a single machine.
In order to improve performance, it is recommended to mark all objects serializable to expand capacity.
While all steps have been taken to make all these objects Serializable, the fortify scanning tool still flags some string variable as vulnerable.
My question is: Are string variables not serialized by default? or I need explicitly mark these variables "Serializable"?