| Server variable | Server | Usually (if website isn't restarted) | Medium | Yes |
| Application variable | Application | Usually (if website isn't restarted) | Medium | Yes |
| Cookie | Application | Usually (user can delete) | Medium | Usually (user can disable) |
| Database | Application | Yes | High | Yes |
| web.config | Application | Yes | High | No |
| Session variable | Session | No | Medium | Yes |
| Query string | Request | Possibly (via bookmarks) | Low | Yes |
| View State | Request | No | Low | Yes |