Session Variables in .NET

[Carl]

Hi,

I am starting to develop an ASP.Net application.

I will have a logon page which will take a UserName and
Password. A Stored Procedure will verify that the logon
is correct.

I was going to use a Session Variable to indicate whether
the user is logged on or not. Based on this variable I
would show certain links, allow access to certain pages.

Is this a good idea or is there a better way?

Thanks.
Carl.

 

[abacnet]

Go here http://www.asp.net/Tutorials/quickstart.aspx and check the
Forms-Based Authentication section. Some of the job is already done for you,
using cookies and encryption. There is also a smple for the login. Good
luck.

 

[Carl]

Thanks for that abacnet.

Thing is that the app will be accessed over the Internet
by strangers who can create an account and login.

So I gues s all I can use is a Session to indicate if
they have logged in or not.

Carl.

 

[abacnet]

I don't see the problem, that's what the cookie is all about. And anyhow I
think the session uses cookies indirectly.

 

[abacnet]

Check this site if you have some time
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetch08.asp