CODEWITHSUNDEEP
htmlsqlvbscriptasp-classic
kurupt_89
kurupt_89

Reputation: 1592

session variables classic asp and passwords

Is it safe to store user inputted passwords in session variables which are used in the connection strings to sql server. If not why and what would be a better way of doing this? The passwords are used to read from sql server.

Upvotes: 0

Views: 496

Answers (1)

Andomar
Andomar

Reputation: 238126

Session state is stored on the server. There is no way for a client to access or change session state, except through code you provide.

The "gold standard" of password storage is to store just the hashed password. But that's not an option if you need the password to connect to the database. So storing it in the session seems like the best way to go.

Upvotes: 1

Related Questions