Question

I am working on a website that uses a remote websites database to check for authentication (they are both share some database tables, but are separate website…)

Right now I check the username and password against the remote websites account / member table, if there is a match I create a session.

Questions:

1. Is this secure? On authenticated pages I just check if a session of
   a specific type exists.Is it possible for someone to create an empty session or something that could bypass this?

2. Is it possible to use Forms authentication with this setup? Right
   now if a user is authenticated I just get an object back with the
   username, email and id.

Answer 1

There is nothing inherently wrong in your design and no problem to use it with forms authentication per se. It all comes down to how you implement it. Good luck!