FYI - Using ViewState is neither private or secure.
The hash that Microsoft uses to code (not encrypt) the ViewState string is
well-known and there are many tools available to decode the string.
If you need a secure way of passing the data you could use the encryption
classes in .NET to encrypt the data you want to pass and then pass it using
any of the methods below.
Don't forget about the most robust solution, passing the data to a database
and then retrieving it later.
-Scott
> I'm finally getting the hang of ASP.NET.
>
[quoted text clipped - 21 lines]
>
> Thanks.
Scott,
> FYI - Using ViewState is neither private or secure.
>
> The hash that Microsoft uses to code (not encrypt) the ViewState string is
> well-known and there are many tools available to decode the string.
Yes, good point. Is it just base64?
> If you need a secure way of passing the data you could use the encryption
> classes in .NET to encrypt the data you want to pass and then pass it
> using any of the methods below.
I'm so far relatively unfamilier with these. If there's a way to checksum
the data to prevent trying to decrypt something that the user just typed in,
that would definitely be something to explore.
> Don't forget about the most robust solution, passing the data to a
> database and then retrieving it later.
Right. But that's not really more secure than setting a Session variable, is
it?
Thanks.

Signature
Jonathan Wood
SoftCircuits Programming
http://www.softcircuits.com