Authentication without using Forms Authentication
===

I am creating a personal website in which I would like users to register for. I have been looking up various security measures that need to be taken, and am curious as to what the main things I have to pay attention to. I have decided to not use ASP.NET Forms Authentication, primarily for the fun of creating the authentication process myself. Here is what I have done thus far:

 - I have a MySQL Database where I am storing the user's login information such as a hash of their password and salt
 - Upon logging in, set a Session equal to their username -- which brings me to the question: Is this the best way to track a logged in user without using Forms Authentication? For example, setting the session would like something like this:

    <code>Session["User"] = username;</code>

Is there a better way to go about tracking logged in users? Or is this an acceptable, yet still secure, way of handling things?

