Hidden fields - security

[boysenberry]

Hi.

I have been using hidden fields to store useful information on ASP.NET web pages between posts. I understand these are not secure because they can be read by looking at view source.

I have since placed them in a panel with its visible set to false. The hidden fields are then not shown in the web page source, but still accessible to my c# code behind.

Is this secure or are the fields still accessible to others browsing the site.

Thanks and regards.

[jhardman]

I believe that this is secure, I'll move your question to the .NET forum to see if anyone here wants to weigh in. Are you talking about code documentation stuff or like posted data that you need to pass on from one page or another?

If you are just documenting, then commented lines don't get sent to the user. If you need data passed along, then this can be sent fairly securely as a cookie (this is sent to the user but encrypted) or as session-level variables (kept at the server). Let me know if this helps.

Jared

[TRScheel]

That will work but there are better ways (Databases, sessions, etc)

[boysenberry]

I believe that this is secure, I'll move your question to the .NET forum to see if anyone here wants to weigh in. Are you talking about code documentation stuff or like posted data that you need to pass on from one page or another?

If you are just documenting, then commented lines don't get sent to the user. If you need data passed along, then this can be sent fairly securely as a cookie (this is sent to the user but encrypted) or as session-level variables (kept at the server). Let me know if this helps.

Jared

Many thanks - I am using them to store values that I pass from one page to another and between postbacks. I thought about cookies, but people turn them off!

Kind regards - I will check the .net forum for any entries.

[jhardman]

Many thanks - I am using them to store values that I pass from one page to another and between postbacks. I thought about cookies, but people turn them off!

Kind regards - I will check the .net forum for any entries.

session variables work really well and simply for this type of thing.

session("userID") = "jhardman"
session("timeIn") = "3:45pm"
 
if session("userID") = "" then response.redirect "login.asp"

Let me know if this helps.

Jared

[TRScheel]

session variables work really well and simply for this type of thing.

session("userID") = "jhardman"
session("timeIn") = "3:45pm"
 
if session("userID") = "" then response.redirect "login.asp"

Let me know if this helps.

Jared

Depends on the how the session state is held. He was discussing the possibility of a user not using cookies, so if the session is cookie based it wont work.

[jhardman]

Depends on the how the session state is held. He was discussing the possibility of a user not using cookies, so if the session is cookie based it wont work.

No, the session variables should be kept on the server by default, the server keeps track of them by session ID. I don't think you can turn of your session identifier as easily as turning off cookies so it is unusual to have a problem with session variables while cookies do fail from time to time. This is the standard way to keep track of shopping cart data or logged-in user info etc. They are robust, can hold large amounts of data, and are much faster to access (and easier to code) than referring to a db every page load.

[TRScheel]

I am talking about the manner that there are three different ways to hold session data. 2 out of the 3 are dependent on cookies to some degree.

EDIT: The third is your method