When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code?
i.e. when a user is authenticated, if I were to initialise a session variable
true I am then able to perform a simple boolean check against the session, and the user's authenticated status, prior to performing any sensitive operation.
However, would it be possible for me to initialise a session variable
authenticated and set this to
true without actually passing a security check? Essentially, could somebody fool my app in to thinking the user was authenticated, when in fact they aren't?