Re: [C#] check I come from ...
"Shanmugam, Kris" <[email protected]>
| Newsgroups | gmane.comp.windows.devel.dotnet.web |
|---|---|
| Message-ID | <3DC4616854D6A84884BCB5FC545B3574DC4097@usplm203.amer.corp.eds.com> |
Session ID is stored on the client side and Session Content / Session Values are stored in-memory on the Server side. The value for Session["lastViewedPage"] cannot be spoofed unless the session itself is hijacked. Am I missing something? Kris -----Original Message----- From: Discussion of building .NET applications targeted for the Web [mailto:[email protected]] On Behalf Of Shanmugam, Kris Sent: Friday, May 11, 2007 9:36 AM To: [email protected] Subject: Re: [DOTNET-WEB] [C#] check I come from ... Are session values stored in a page? I was under the impression that only Session IDs are stored in a page. Am I wrong? Kris -----Original Message----- From: Discussion of building .NET applications targeted for the Web [mailto:[email protected]] On Behalf Of Efran Cobisi Sent: Friday, May 11, 2007 3:16 AM To: [email protected] Subject: Re: [DOTNET-WEB] [C#] check I come from ... Christopher, From the security point of view, this solution is secure as the HTTP referer one. Users could open each one of the pages in different windows and spoof the value the last opened page has stored in the session. However, I'm still wondering if security is an issue for this problem. Gabriel, could you answer to this one? HTH -- Efran Cobisi http://www.cobisi.com Christopher Frazier wrote: > Use Session["lastViewedPage"] or something like that. Just set it to the > current page in the PreRender event, and check for the correct one in Load. > > -- > -Christopher > | AspInsider > http://chrisfrazier.net/blog > =================================== This list is hosted by DevelopMentor(r) http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com =================================== This list is hosted by DevelopMentor(r) http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com =================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com