What kind of data should never go into session?

asp.net, session

Solution

I really wish it was clearer what kind of session you mean. Depending on the answer, I can come up with a couple:

- Passwords of any sort

- Large amounts of data, especially 4 GB+ on a 32-bit OS (guaranteed out of memory if it has to be loaded into RAM)

- Executable code

- Raw SQL

- Swear words

- Things likely to get government agencies angry ("Free Tibet" in China, threats to the president in the US)

- Your bank account PIN or credit card number

- A rabid badger. Actually, ANY kind of badger.

Problem

Original source