Question

I have the following code in my web application asp.net using C#:

            bool isValid = pc.ValidateCredentials(username.Text, password.Text);
            if (isValid == true)
            {
                Session["user"] = username.Text;
            }

The username is actually a textbox. The end-user will key in their username and password, which will authenticate against a AD (Active Directory) server using the PrincipalContext pc.

So, I was wondering if it is safe or are there improvement to be make for the above code so that it can be more secure?

Answer 1

Yes, storing the username in the session is safe because the session is stored on the server. On the other hand you probably want to read about Forms Authentication to make sure that you are not reinventing some wheels.