I am developing an asp.net 3.5 public website on Windows Server 2003 R2
(using IIS 6.0).
The website has unsecured parts which use plain http:, an SSL-enforced https:
unsecured directory for logging on to asp.net forms authentication, and an
SSL-enforced https: secured (forms authentication) directory containing various
aspx files for users to make transactions once they have passed Forms
Authentication login.
I wish to store temporary information relating to the transactions using
state (and the server runs state inproc - and it doesn't matter if the state
info is lost occasionally if the site goes down, as the user will in that
unfortunate situation just have to login again and recomplete their
transaction).
It would be a threat if someone managed to obtain the info I am storing in
state though.
I have read a number of articles about the dangers of storing information in
state, an ...
Go to the complete details ...