A question for ASP and MS types

date posted 1st November 2002 12:36

This is a multi-part message in MIME format.

------=_NextPart_000_00B5_01C281A4.2C4208E0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_00B6_01C281A4.2C438F80"


------=_NextPart_001_00B6_01C281A4.2C438F80
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Eonic StationeryI am writing a system using active directory for logons.

I want to store some logon information specifically a username as a session
variable.

How easy would it be for a hacker to set his own session variables? I
personally can't think how it might be done.

I know most systems are not hacker proof and I don't expect it to be 100%
secure, but I don't want it to be stupidly easy either.

I allready know the downsides of using sessions from a performance
perspective.

Please lets not get drawn into a Microsoft hating debate, or telling me I
should be using PHP or some other far superior technology.


Kind Regards

Trevor Spink - CTO

Eonic Ltd.
32a Lansdowne Road, Tunbridge Wells, Kent. TN1 2NL
t: 01892 534044 m: 07973 172892 e: [EMAIL REMOVED]
www.eonic.co.uk

This e-mail may contain confidential and/or privileged information. If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden.



------=_NextPart_001_00B6_01C281A4.2C438F80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


Eonic Stationery



I am =
writing a=20
system using active directory for logons.
 
I want =
to store some=20
logon information specifically a username as a session=20
variable.
 
How =
easy would it be=20
for a hacker to set his own session variables? I personally can't think =
how it=20
might be done.
 
I know =
most systems=20
are not hacker proof and I don't expect it to be 100% secure, but I =
don't want=20
it to be stupidly easy either.

 
I =
allready know the=20
downsides of using sessions from a performance =
perspective.
 =

Please =
lets not get=20
drawn into a Microsoft hating debate, or telling me I should be using =
PHP or=20
some other far superior technology.
 
 
Kind Regards
Trevor Spink - CTO
Eonic Ltd. 32a=20
Lansdowne Road, Tunbridge Wells, Kent. TN1 2NL t: 01892 534044    m: 07973 172892   =
e: