is there any security issue realated to leaving ASP.NET Session ID value on html hidden field?
Its in order to work around a problem when using uploadify, which is based on flash to work and have known problems (this link, look for 'STEP 6') in sending the right cookies to the server through ajax request so I'm having problems when trying to authenticate against my session based authentication process.
By puuting SessionId value in a hidden field it allows me to grab the right valu and after some code on global.asax sucefully work around this problem.
Am I doing something totally wrong? Btw, im using 128bit ssl encryption.
Thank you!!!
EDIT: The point is, if session ids are alaways present in https post/request, whats the difference if I store them as a post argument or as cookie value beign sent within an http req.? If someone that intercepts my req and get my SessionId can easily bypass security, whats the best way to implement autenthication???