If using Cookies Inline in ASP page is Safe???

[Amit Jamgade]

Hi,

I am making use of cookies to store the Session State information
through JavaScript as given below in an ASP Page. Suppose I have XYZ.asp
page. The code in this page goes as shown below.
*************** *************** *************** ************
<%
'Remark: ASP Code here
dim staffID
dim TaskCD
set objFile = server.CreateOb ject("PTSUFILE. PTSUFILESRV")
%>
<Script language="JavaS cript">
var environment;
var physicalpath;
var userid;

environment = window.opener.d ocument.FORM.as _environment.va lue;
physicalpath = window.opener.d ocument.FORM.as _physicalpath.v alue;
userid = window.opener.d ocument.PTSFORM .as_userid.valu e;

document.cookie ="Environmen t=" + environment + "";
document.cookie ="PhysicalPath= " + physicalpath + "";
document.cookie ="UserID=" + userid + "";

</Script>
<%
'Remark:ASP Code Continues Here
'Remark:Get the physical path from cookies and set cookievalue to blank.

Dim physicalpath
physicalpath = Request.Cookies ("physicalpath" )
Session("StrPhy sicalPath") = Cstr(physicalpa th)
Response.Cookie s("physicalpath ")= ""

*************** *************** *************** ************

Here I am trying to get the Session data from an previous page into a
new opened window ASP page throuh javascript.

And I am doing it so becos, I am sharing my session data across asp and
aspx pages in the same application. So i have a custom session object
which I fetch and store in oracle 9i database each time a request is
made to webserver.

I just want to know if I set the Response.Buffer Property on the top of
asp page to true. And use the above inline JavaScript code to store data
like Path, UserId in cookies. Again then fetch this data immediately in
the next line in ASP code from cookies and then set the cookies to
nothing. Is this way of using Cookies to store the session data is safe.
As I am immediately destrying the cookie data once I get it in my asp
page for use.

Please reply ASAP...
Thanks in Advance !
Regards,
Amit
*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!