From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Securing sessions

Securing sessions

From the course: ASP.NET: Security

Start my 1-month free trial

Securing sessions

“

- [Instructor] Sessions are a virtual concept, so to speak. A user visits a website, clicks on a few links, and then, well, close the browser, doesn't do anything for a certain amount of time. This ends the session with the website. Technically, in SPO net, that's how it works. The client sends an HTP request to the server. The server replies and sends, once again, the set-cookie HTP header. However, there is no actual information that's usable for the client. In that cookie, there's no cleartext information. Instead, the user receives a session ID that's an identifier for the current session. This is the cookie, so the client stores it, and with each and every subsequent request, that cookie is sent back to the server. So the server always knows that's this specific session. And if the user is locked in, for instance, that's this specific user. Of course, on a server, there's a kind of database in memory or a real database where the session ID is more or less the primary key for some…

Contents