I am writing an ASP.NET web app and am wondering if there is anything that is insecure to store in HttpSessionState.Session?

More specifically, is it bad practice to store such information as UserID, or security permissions in the Session? My concern is that this information can be spoofed by a user/hacker to give themselves permissions afforded to another user.


Objects stored in a HttpSessionState session are stored on the server-side. They can only be accessed by your application code, not by the client (the browser) or the user using the browser like a client-side storage mechanism (like cookies) might allow.

So, there is no direct way for a user to tamper with or modify the value of session objects. The only way a malicious user can abuse session state would be to steal an entire sesssion, which is known as a session hijacking attack, or force a victim user to use a specific session, which is known as a session fixation attack. This is accomplished by taking the value of a cookie that is sent to the browser that identifies the session a user is associated with, so that it can be accessed on subsequent requests. If a malicious user can steal another user's session cookie/id or force another use to use the attackers previously established session id, (often relying on separate cross-site-scripting attacks to accomplish) the attacker than then either impersonate the victim, or get the victim to perform an action on the attacker's behalf.

Even in these cases, however, the attacker is limited to the transfer of the session in its entirety. He or she still has no control over the values of the properties stored server-side for the session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.