title: Sensitive data in Viewstate?
body: <p>I need to store sensitive data across few pages (run over https) per session.</p>
  
  <p>I can't use session object, for the primary reason being that the session store is designed as just as backup store (primarily make service calls and load the session). If the session has been restarted or in other words that the key in the session does not exist, make the service and re-populate the session.</p>
  
  <p>So, in the case of user keyed in sensitive data, i need to carry this data forward across pages, we do not have a persistent store for now, therefore option left is storing these sensitive data in Viewstate. </p>
  
  <p>1) Should I encrypt the data and store then in Viewstate (not recommended though - sec &amp; perf. implications)
  OR
  2) Should i store the data in a serializable class and store that in Viewstate? (not recommended again due to perf. implications)</p>
  
  <p>Any opinion please?</p>