Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication.
For Example if somebody hacked my computer and got the ticket so he is able to gain access to my account, the same for the session Id if somebody stole it, so I do not know how it is more secure.
I think that we can use some techniques to protect the cookie from being stolen like to bind the active session with a token which always send with the active session.
So please could any body explain me if it is really more secure to use Form Authentication rather than Session Authentication.
I am wondering why do not send the ticket it self in the HTTP request it self rather than storing it at the cookie, in this case it will play the role of the token and the identifier at the same time.