In an ASP.NET web app, using Integrated Windows Authentication, is the session tied to the windows identity?
In other words, if I login (using IWA) to the app, and the app stores some "stuff" in my session, is this stuff accessible by session id alone? For instance, if a malicious someone managed to steal my session id, but NOT my credentials, can he then access my session stuff? Or is this session accessible only to the same identity, requiring both the session id AND the windows identity to access it?
Session Management with Windows Authentication
4.1k Views Asked by AviD At
1
There are 1 best solutions below
Related Questions in ASP.NET
- S Cannot be resolved. Clojure. Cursive
- Rust Cursive EditView setText function
- Cursive: Clojure's *out*, different Writers, flushing and ordering inconsistency when multithreaded: what is going on?
- Clear Cursive REPL state before each test run
- how to run junit tests that require classes compiled from clojure in intelliJ
- How do I stop IntelliJ Cursive from re-formating my Clojure code?
- why cursive font does not Works in my browser?
- IntelliJ/Cursive unexpected issue
- Getting context help in Cursive IDE?
- IntelliJ (Cursive) REPL evaluation in namespace
Related Questions in IIS
- S Cannot be resolved. Clojure. Cursive
- Rust Cursive EditView setText function
- Cursive: Clojure's *out*, different Writers, flushing and ordering inconsistency when multithreaded: what is going on?
- Clear Cursive REPL state before each test run
- how to run junit tests that require classes compiled from clojure in intelliJ
- How do I stop IntelliJ Cursive from re-formating my Clojure code?
- why cursive font does not Works in my browser?
- IntelliJ/Cursive unexpected issue
- Getting context help in Cursive IDE?
- IntelliJ (Cursive) REPL evaluation in namespace
Related Questions in WINDOWS-AUTHENTICATION
- S Cannot be resolved. Clojure. Cursive
- Rust Cursive EditView setText function
- Cursive: Clojure's *out*, different Writers, flushing and ordering inconsistency when multithreaded: what is going on?
- Clear Cursive REPL state before each test run
- how to run junit tests that require classes compiled from clojure in intelliJ
- How do I stop IntelliJ Cursive from re-formating my Clojure code?
- why cursive font does not Works in my browser?
- IntelliJ/Cursive unexpected issue
- Getting context help in Cursive IDE?
- IntelliJ (Cursive) REPL evaluation in namespace
Related Questions in SESSION-MANAGEMENT
- S Cannot be resolved. Clojure. Cursive
- Rust Cursive EditView setText function
- Cursive: Clojure's *out*, different Writers, flushing and ordering inconsistency when multithreaded: what is going on?
- Clear Cursive REPL state before each test run
- how to run junit tests that require classes compiled from clojure in intelliJ
- How do I stop IntelliJ Cursive from re-formating my Clojure code?
- why cursive font does not Works in my browser?
- IntelliJ/Cursive unexpected issue
- Getting context help in Cursive IDE?
- IntelliJ (Cursive) REPL evaluation in namespace
Related Questions in SESSION-HIJACKING
- S Cannot be resolved. Clojure. Cursive
- Rust Cursive EditView setText function
- Cursive: Clojure's *out*, different Writers, flushing and ordering inconsistency when multithreaded: what is going on?
- Clear Cursive REPL state before each test run
- how to run junit tests that require classes compiled from clojure in intelliJ
- How do I stop IntelliJ Cursive from re-formating my Clojure code?
- why cursive font does not Works in my browser?
- IntelliJ/Cursive unexpected issue
- Getting context help in Cursive IDE?
- IntelliJ (Cursive) REPL evaluation in namespace
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Excellent question. I just ran a test to confirm before i wrote this answer.
If i am 'Person A', and you are 'Person B', then this is what has to happen:
Note that Person B is still recognised as 'Person B' by the website, even though they are using Person A's session details. So if you have code that checks user permissions etc, then those checks are still done in the context of Person B.
This might sound like a huge issue, but it isn't really as long as the programmers are not careless. For instance, the only effect that Person B got in my test above was that they inherited the screen and grid layouts that Person A had set up, because we do our permission checks live (i.e. they are not cached). If you store sensitive data in the session then it could be a problem, but it is only a problem if they fields showing it are not permission checked every single time they are shown. It's also only an issue if the session for Person A hasn't expired.