Int-UserID and Session in ASP.Net unsafe?

I am developing my login for my new homepage.

Now I found out, that I must save something like the userID (or another value that i can recognize my user) in the session variable of the browser.

At the moment I use INT for the userID.

So isn't it unsafe to put the userID in the session?

E.g. when I edit my session variable manual from userID 111 to userID 开发者_如何学Go112, than I am logged in as a complete other user?!

---

Yes, it is unsafe to rely only on user ID.

You may wish to add a unique authentication token generated and remembered by the server. Also a very simple solution, but it will stop manipulating the user ID since the correct value for authentication token for the other user cannot be guessed.

You also need to submit both user ID and the corresponding authentication token at each request to be jointly validated on the server side, prior to performing the requested operation.

P.S. The above applies if you store this information in cookies which are accessible on the client side and can be manipulated. The viewstate (serialized in pages) can also be manipulated. The session collection is a server-side variable that is not available on the client so it cannot be manipulated. In this later case your user ID should be safe.

I would recommend you to implement the dual system: store the user ID and the token both in cookies and in the session and use the same validation logic (for simplicity). Should cookies be disabled you automatically fallback to using the session without changing your code.

---

The session variable is not stored in the browser, it is stored on the web server. (Typically anyway.)
A token indicating which session variable to use, is stored in the browser.

So storing the userid in the session variable is fine, as the user has no access to this directly.

If the user were to change the session token, to another one, that would be a problem, but they'd need to know the other token first. (I'm not sure how to do that myself.). (You can further diminish this by using encryption, or other identifies like IPAddresses etc, it's really a case of how secure do you need your website to be?).

Also, if your site needs the user to log in, it's advisable to use https/SSL.

---

As Bravax says, the user does not have access to the Session variables (Cookies they do have access to).

If you are worried at all I would use a GUID instead as they are not sequential and nearly impossible to guess.

Also, have you looked at the built in stuff in .Net for authentication? Look at FormsAuthentication.

HTH, Arry