title: Does sensitive ASP.NET Session data need to be encrypted?
body: <p>Do ASP.NET Session[string key] data need to be encrypted to be secure?</p>
  
  <p>If such data always stays on the server, doesn't that make it safe to store credit card information, passwords, etc. there, as long as the data were sent via SSL from the client?</p>