Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way.


var sessionId = ValidateCredentials();

// below embeds specified javascript into response. the javascript sets the browser's sessionStorage.SESSION_ID and performs a redirect to home page

My concern - this means we are temporarily placing the session id in the login.aspx html response, does this pose any security risks at browser side?

I think it shouldn't as it is no different than sending sensitive information in an xml/json response (which I believe is a norm in most of SPA web apps).

The reason this got me concerned is because the html responses are treated as sources by the browser and I don't know if it is possible for an attacker to get the source file contents or if there are some other reasons which makes this a bad practice.

Note: There are other ways user authentication can be managed (httponly cookies, asp.net session etc etc..), but for argument sake, lets say we have to store the sessionid in browser's sessionStorage and I can only come up with above to achieve this.

Thank you.


Is it a bad practice to send sensitive information(like a session id) in the aspx response?

No.From a security perspective sending sessions id in a response doesn't make it insecure.Also use POST method if you intend to send that session back in a request.


From a development point of view its better to send session as cookies rather.Most Languages have SESSION management inbuilt.Why not use that?

browser and I don't know if it is possible for an attacker to get the source file contents

That's possible only if there is an XSS flaw.Session identifiers in a cookie might be immune to that if you use httponly. Another reason to use cookies.

  • Yeah, cookies would be a good option, but unfortunately we cannot do that(we have to have session id stored in the sessionStorage). If an XSS flaw does exists, it will not matter if I am passing the session id in the aspx response, it can just straightaway access the sessionStorage.SESSION_ID(whether or not it is passed via aspx response) Jul 5 '19 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.