1

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application.

All of them will use really confidential information. Right now I'm thinking how they all will authenticate.

But what is the best way to save login: with Session variable or with cookies?

Or maybe both?

Right now I'm working with ASP.NET and the session variables are saved in a base64 string (maybe this is a little bit more secure but I don't know).

  • 1
    Could you go into more detail about what this means: But whats the best way to save login... What is "saving login"? – Abe Miessler Apr 8 '15 at 21:49
  • Sorry. I mean the token to authenticate the user. Thanks for the correction. – NathanWay Apr 8 '15 at 22:51
4

Based on the way your question is structured, it seems like you might be confused about what authentication cookies and session variables are and what they should be used for. It also seems like you are planning on rolling your own authentication/authorization functionality.

One thing that ASP.NET offers is that it will handle many of the details of authentication/authorization for you. When used properly this is very secure.

I would recommend giving this article a read to get a better understand of how authentication/authorization worKs and what your options are with ASP.NET.

I would recommend reading up on how ASP.NET Session State (including Session variables) work by reading this article.

Best of luck!

  • Thanks for the answer. Yeah thats what I like of ASp.NET the viewstate y very useful. I'll give a read to that. Thanks – NathanWay Apr 8 '15 at 22:52
3

You could consider using JWT (JSON Web Token) which is becoming quite popular. Essentially how it works is your user logs in to your system and your application generates JWT and sends it with the reply. JWT contains standard fields like "subject", "audience" etc. (you can also define custom attributes), It also has an expiry date and it is cryptographically signed. Your user includes the JWT with each request in HTTP header, directly in the URL or in the cookie. Your server validates signature and analyses attributed to establish access rights.

The main advantages are that it is undergoing standardization at IETF right now and it is currently used by substantial number of cloud providers for securing API access. Another advantage is that if you ever need to grant access to your app to a third party it would be easy to integrate as there are libraries that support JWT for almost any platform including .Net (see the first link). Or if you ever decide to expose your API for mobile clients - it will work out of the box. Your application can be stateless this way (good for load balancing) but you will likely need to use cookie for web browser access.

-1

base64 encoding plaintext is bad, anyone can decode base64. Use encryption before you base64 encode your variables or any other plaintext strings.

Sessions are much more secure then cookies.

  • 2
    base64 encoding is not bad - it just doesn't offer protection, only encoding. It is ok for the session variable to only be encoded and not encrypted depending on how the session variables are used and what is contained in them – schroeder Apr 8 '15 at 21:28
  • Well I dont think ASp.NET let you decode that bas64 string. But i'll see thanks fro the answer... – NathanWay Apr 8 '15 at 22:51
  • 1
    @NathanWay anyone can decode a base64 string. – schroeder Apr 8 '15 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.