Sessions and web security

Question

Hi I am securing my webpages that I want no one to access it I know that I can use the membership and roles given by asp.net to do that but I don't want to use them what I am doing is that I added a login button on the page that all users have access to it and then with this login button you need to add your username and password when you press on this button you got the username and password saved in a session so the page load method of the next page will see those sessions if they are registered in the table it will load the page otherwise it will redirect the user to the previous page.. So first of all is this method secure? can anyone add a whatever username or password such as the usernames and passwords used by hackers to access the page? and how to chage the session timeout I've found this topic : http://forums.asp.net/t/1283350.aspx b ut I don't know if I must do that on the webhosting server or where? thanks.

Shivanand Arur · Answer

Sessions are very powerful and safe... Since Sessions are stored on the Server machine ( if the mode is InProc ) there wont be any problem. For login I hope you are first checking the User's Credentials with the information stored in your database. For example - My Username is - Member1 and My Password is - MemberPass . These Credentials are stored in my database. So When I login I first check wether these credentials match with the database values. If they do then the User can login otherwise he will be re-directed to some other page. Once again using session is safe... Do not worry... I hope I have answered your question properly... If you still have any doubt then feel free to post it. Check out this Article to learn more about State Management. http://www.c-sharpcorner.com/UploadFile/78d182/Asp-Net-state-management-techniques/ Thanks.

abed akhi · Answer

thanks.

Shivanand Arur · Answer

By default the timeout of the session is 20 minutes. It means that if the user is inactive(the user has logged in but not using the site since 20 minutes then he will be logged out automatically and the User will again have to login.) You can increase it to even 60 minutes from the web config file. It completely depends upon you. I would recommend to keep the default value. Changing the timeout won't affect your site. Once you publish your site and upload it you do not have to make any other changes. The timeout you mentioned in your web config will be the default time for that specific session to be active. Do not worry... Inproc is the mode of the Session object where the Session object is store in the same process in which your application is running. This is the default mode of a Session. There are many other ways of storing the session like... State Server mode Sql Server Mode Off.... If you do not about its configuration then do not make changes in it. Please Mark My Asnwer as ACCEPTED if you feel it helped you.

abed akhi · Answer

Thanks yeah sure I do check those from an existing database but just one thing do the state and timeout of the session have to be modified on the webhosting server if I am adding my website there?and what is the Inproc mode of a session does this mean that it won't be timedout?