would someone be kind enough to shed me some light on the following concepts? these aren't assignment or exam questions, just things i couldn't find in the book i am reading and unbingable.
* how would forms authentication be made to work if cookies aren't enabled?
* session state can be stored in a cookie or within a munged url. if latter, then for a 'busy' website, there would be a higher likelyhood that a naughty user can replace the session state portion of the url with some random value and 'steal' someone else's session?
* once a user has been authenticated (either via forms or windows), can session state be used from then onwards as a mechanism to identify if a user is who he says he is? at least until the session expires (is made to expire) and then the user has to login again?
* as I understand it, IIS and ASP.Net are both services running in a web server OS. As such they need a logon account to run as. For ...
Go to the complete details ...