title: ASP.NET MVC 4 and session security leak
body: <p>Instead of using ASP.NET MVC User's system, I'm simply using session, as the following:</p>
  
  <p>When he logs in (username + password), I fetch the corresponding user from the Database and set:</p>
  
  <pre><code>Session["UserId"] = fetchedUser.UserId;
  </code></pre>
  
  <p>Then, I'm always checking if he is logged in:</p>
  
  <pre><code>if (Session["UserId"] != null &amp;&amp; ...)
  </code></pre>
  
  <p>The problem is that if someone copies the value of ASP.NET_SessionId from a logged in user (eg: <em>user goes to bathroom and coworker who is sitten next to him checks his cookies with chrome inspector</em>), then he will be able to create a cookie in his computer and act as that user.</p>
  
  <p><img src="https://i.stack.imgur.com/FtFRh.png" alt="Chrome&#39;s inspector"></p>
  
  <p>My questions are:</p>
  
  <ol>
  <li>Why are sessions safer than cookies if the session id is saved in a cookie?</li>
  <li>Can I make this safer (and continue using session)?</li>
  <li>How does internally ASP.NET User authetication system do it?</li>
  </ol>