Hello I am putting the architectural design of an ASP.NET application. the application will be used by multiple adminstrators and users with different authorities. I plan to use session variables to manage log on to the system. in the log on page, the user enters his username and password, then they are checked against the database and his role is checked too. a "Role" session variable is added with value indicating the role of the user or administrator. on every page of the application, the "Role" session variable is checked when loadig the page, and based on its value the user is allowed to view the page or redirected to "Not allowed" page. I have two questions: 1.. Is there a better way to manage the permissions and logons? 2.. Are the session varaibles safe? is there a possibility that a hacker or a process could alter the session variables?
=================================== This list is hosted by DevelopMentor® http://www.develop.com View archives and manage your subscription(s) at http://discuss.develop.com
