Security based on session, what's wrong?

From: Matt (none_at_none.com)
Date: 04/27/05 

Date: Wed, 27 Apr 2005 10:54:10 +0200

Hello,

I'm working on a portal derived from IBuySpy, and I have changed

I check username and pwd against a database, then I make a
Session["User"]= UserID (the ID I get from the database, if it
exists).
Now I create all the pages based on that ID stored in a session
variable.
If that user is authorized to see a certain tab, module or content,
the page is created that way. All the auth info (user/contents) are
stored in another database table.

Everything works fine without use fo forms authentication.
Is there something wrong with it? should I use forms authentication?
why?

Thanks,
Mattia

Relevant Pages

  • ASP.NET Forms Authentication Best Practices
    ... ASP.NET Forms Authentication Best Practices ... What happens if your user database is compromised? ... Listing One, where you want to use login.aspx to log users in. ... string FirstName ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Security question ..
    ... What I want to prevent is any access to the database accept through our ... application unless you have elevated permissions. ... Authentication, if he is smart enough to create an NT Auth ODBC connection ... passes through to the database or to use SQL Server authentication. ...
    (microsoft.public.sqlserver.server)
  • User authentication over the web (was: Secure Password in database)
    ... Subject: User authentication over the web (was: Secure Password in database) ... a web server is usually authenticated to users by using SSL or TLS ...
    (SecProg)
  • Re: Using SSPI with Custom Authentication
    ... It boils down to moving the security perimeter away from the server. ... first database contains all of the user information; ... perform authentication, and users need to be authenticated before accessing ...
    (microsoft.public.dotnet.security)
  • Re: SQL Express MDF file moved from 1 computer to another - auth f
    ... I try to attach the database which is located in MyDocuments\Visual ... Microsoft SQL Server Management Studio ... now it tells me that authentication has failed for my windows ...
    (microsoft.public.sqlserver.connect)