ASP.NET MVC ViewBag / TempData Security

Question

I´m developing a web application on ASP.NET MVC and I´m using ViewBag and TempData to store some values that will live as long until the user logout. I.e: what user is logged in, some internal IDs so I can check roles and another values that the user should not know.

My questions are:

Is ViewBag / TempData good for this uses? Am I using it right or wrong?
Are these tools secure?. Can the user sniff this values someway?.

Thanks for your answers.

Why are you mixing ViewBag and tempdata? They are different things for different uses. You should post an example of what you are doing. By the way, none of them are useful to store data that must live more than one http request — tede24
– tede24, Commented Feb 20, 2016 at 17:42
For your purpose of checking user's role you can use MVC's role based Authorization like [Authorize(Roles = "Administrator")] .... Your For your query (2): Yes, they are secure... but is not for your purpose of storing something for long duration. For such duration developer mostly use Session which too is secure — Rajiv Bhardwaj
– Rajiv Bhardwaj, Commented Jun 23, 2017 at 10:47

Peter Smith · Accepted Answer · 2016-02-20 17:54:46Z

2

TempData persists only until the next page access; ViewBag is used to pass values from the controller to the view. Neither are suitable for storing information which will last for the session. On security, they are both server side and the user will not be aware of them, so, yes, they are secure.

If you want to persists values for the duration of a session they you need a different mechanism. Several are available to you. My favourite is the use of session variables but some developers are firmly against session variables. You need to research your options further.

answered Feb 20, 2016 at 17:54

Peter Smith

5,5529 gold badges54 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ErTR Over a year ago

Have a look before using Session: brockallen.com/2012/04/07/think-twice-about-using-session-state

Peter Smith Over a year ago

Thanks, there are many comments both for and against as I noted in my answer,

MartijnK · Accepted Answer · 2016-02-20 17:55:03Z

1

You should store session based data in a session.

ViewBag is there for incidental data that is needed in View. Page titles, things like that. For other data that is needed in the view, you should be using the model.

TempData is for incidental data that is needed by the next action. It can store data for one roundtrip between server-client-server; after that it is removed unless you specifically make it stick around.

None of these expose data that is a security risk, unless you are silly enough to send security data to the client on purpose.

answered Feb 20, 2016 at 17:55

MartijnK

6725 silver badges19 bronze badges

Comments

Rajiv Bhardwaj · Accepted Answer · 2017-06-23 10:48:20Z

0

For your purpose of checking user's role you can use MVC's role based Authorization like [Authorize(Roles = "Administrator")] .... Your For your query (2): Yes, they are secure... but is not for your purpose of storing something for long duration. For such duration developer mostly use Session which too is secure

answered Jun 23, 2017 at 10:48

Rajiv Bhardwaj

2933 silver badges9 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC ViewBag / TempData Security

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related