Re: [C#] check I come from ...
Chris Anderson <[email protected]>
| Newsgroups | gmane.comp.windows.devel.dotnet.web |
|---|---|
| Message-ID | <[email protected]> |
I think that';s why Afran said "open each one of the pages in different windows" i.e. Open page1 (session says last page was page1), then open page2 in a separate window (session says last page was page2) Now go to the first window (showing page1) and open page3 - which looks into the session and sees that page2 was the last page - whereas the referrer server var would show page1 ________________________________ From: Discussion of building .NET applications targeted for the Web on behalf of Shanmugam, Kris Sent: Fri 11/05/2007 16:31 To: [email protected] Subject: Re: [DOTNET-WEB] [C#] check I come from ... Session ID is stored on the client side and Session Content / Session Values are stored in-memory on the Server side. The value for Session["lastViewedPage"] cannot be spoofed unless the session itself is hijacked. Am I missing something? Kris -----Original Message----- From: Discussion of building .NET applications targeted for the Web [mailto:[email protected]] On Behalf Of Shanmugam, Kris Sent: Friday, May 11, 2007 9:36 AM To: [email protected] Subject: Re: [DOTNET-WEB] [C#] check I come from ... Are session values stored in a page? I was under the impression that only Session IDs are stored in a page. Am I wrong? Kris -----Original Message----- From: Discussion of building .NET applications targeted for the Web [mailto:[email protected]] On Behalf Of Efran Cobisi Sent: Friday, May 11, 2007 3:16 AM To: [email protected] Subject: Re: [DOTNET-WEB] [C#] check I come from ... Christopher, From the security point of view, this solution is secure as the HTTP referer one. Users could open each one of the pages in different windows and spoof the value the last opened page has stored in the session. However, I'm still wondering if security is an issue for this problem. Gabriel, could you answer to this one? HTH -- Efran Cobisi http://www.cobisi.com =================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com