Hello! I am developing the application that stores current user and user's role to session state (System.Web.SessionState.HttpSessionState Page.Session).

        if (Session["username"] == null)
            Session.Add("username", User.Identity.Name);

        if (Session["isAdministrator"] == null)
            Session.Add("isAdministrator", User.IsInRole(domain + "\\Domain Admins"));

After I check these session states in code behind for granting permissions to some excecution:

    if ((bool)Session["isAdministrator"] || computer.Administrators.Contains(Session["username"].ToString()))

My question is next: how safe that mechanism is? Is it possible to change the session states using some JavaScript for example or some how else?

Thanks :)