Encrypting the session section in web.config file.

Question

After encrypting the session section, change it in plain text and also change the timeout, So I verified it is taking the plain text timeout, but this wrong it should take time of encrypted part as what will be benefit of encrypting session.
Anybody can change the session, and increase the timeout, so please give the solution for it.
How to secure session timeout in web.config file

Salman Beg · Accepted Answer

It will consider only plain text timeout, not encrypted one. Thanks

Salman Beg · Answer

Hey. timeout in session uses int datatype so it will only accept int value. But if you encrypt the value and assign to it then it will not work. Thanks.

Salman Beg · Answer

Because timeout internally uses int datatype. So if you give 20 or 30 then automatically it takes as 20 or 30 minutes. But if you give any encrypted value then it is unable to understand. Thanks.

NIKITA PANDEY · Answer

Ok, it will take the plain text timeout, but why ?  Please Explain it. Then what is the benefit of encrypting session timeout, if anybody can change the timeout.

NIKITA PANDEY · Answer

ok, but I am not changing in encrypted part, I have removed the encrypted part and put the plain text session, so it is not taking encrypted session timeout, it is considering plain text timeout. So how to fix this issue?