Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way.
My concern - this means we are temporarily placing the session id in the login.aspx html response, does this pose any security risks at browser side?
I think it shouldn't as it is no different than sending sensitive information in an xml/json response (which I believe is a norm in most of SPA web apps).
The reason this got me concerned is because the html responses are treated as sources by the browser and I don't know if it is possible for an attacker to get the source file contents or if there are some other reasons which makes this a bad practice.
Note: There are other ways user authentication can be managed (httponly cookies, asp.net session etc etc..), but for argument sake, lets say we have to store the sessionid in browser's sessionStorage and I can only come up with above to achieve this.