This might be a silly question, but is there any reason at all to use
session variables with a "roll your own" type solution for authentication as opposed to
simply using forms authentication in ASP.NET? I've seen way too many implementations
where each page checks a session variable to see if it's true to determine if a
user is authenticated, often this is delegated to a common base page. I
have a strange suspicion that this is a result of old ASP developers that
converted to .NET without actually learning the functionality available in the
framework. Thoughts?
...
Go to the complete details ...