When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code?

i.e. when a user is authenticated, if I were to initialise a session variable authenticated as true I am then able to perform a simple boolean check against the session, and the user's authenticated status, prior to performing any sensitive operation.

However, would it be possible for me to initialise a session variable authenticated and set this to true without actually passing a security check? Essentially, could somebody fool my app in to thinking the user was authenticated, when in fact they aren't?

2 Answers 2


Not directly.

Session data is stored and accessed server side, the client only has access via any external access methods you have defined. All that is stored on the client is the session key, which is the point of vulnerability. To my understanding, most attacks on sessions involve getting another users' session key, and moving forward from there. The primary tool to prevent this is implementing sll/https, preferably over the entire web app.

Of course, this assumes your web app is set up securely, remember that a user with the correct tools can enter whatever form/ajax/SOAP data they like, and isn't limited by the interface and client code you've created.


yes, trivially. If I understood correctly the session variable will be at points sent back from client-side?

Have a go with tamperdata.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .