session variable security vunrability? 1

[gus121]

The website i am supporting has the DSN database connection string (e.g password, username, database connection) stored in a session variable. Is this risky for hackers? Would an Application variable be a far better way of globaly storing this variable for performance? security?

Thanks

Angus Angus

http\\

http://www.TDCi.eu.com

http\\

http://www.sailgb.com

 

[rmusgrove]

I suppose the advantage to using a Application var is that there would be only one copy of the DNS info, which is shared by all sessions, as opposed to a separate copy for each session, as would be the case for a Session var. As far as this being a security issue ... I don't know. I would think an App variable would be easier to hack than a Session variable, actually. I don't think either are particularly "hackable", but if a hacker knew how to get all the memory structures for a running web site, I'd have to believe it would be easier for him to find the App variables in there than the Session vars.

 

[Tarwn]

To add to what rmusgrove has said, if a hacker knew how to get all the memory structures for a running website, than I think tracking down your DSN information would be pretty far down the list considering a) how complicated that would be and b) How many more important things they would then have access to

Just my opinion [sub]01010100 01101001 01100101 01110010 01101110 01101111 01101011 00101110 01100011 01101111 01101101 [/sub]
[sup]29 3K 10 3D 3L 3J 3K 10 32 35 10 3E 39 33 35 10 3K 3F 10 38 31 3M 35 10 36 3I 35 35 10 3K 39 3D 35 10 1Q 19[/sup]
Get better results for your questions: faq333-2924
Frequently Asked ASP Questions: faq333-3048

 

[mwolf00]

As to using Application variables for connection strings - read onpnt's final reply in thread333-505276. Get the Best Answers! faq333-2924
Is this an asp FAQ? faq333-3048
Tek-Tips Best Practices: FAQ183-3179

 

[rmusgrove]

No, mwolf00.

The way I read it, what onpnt is saying there is "don't store objects in App or Session vars. I don't recommend that, either. Connection strings, however, are just strings, and a case can be made that there are conditions where having a particular string available for the duration of the server "Application" is advantageous.

If there was never any good reason to use Application or Session variables for anything, I don't think they'd be around for us to use.