Packet Sniffing and Sessions

Question

Let us say that I have a website and that I created a session containing an encryption key. Can a packet sniffer such as Fiddler be able to get the contents of this session, thus compromising the website's security?

Answer 1

No because the key never goes through the network between server and browser. Session variables are stored in memory in the server machine. The attacker can only read the key if he gains access to the machine or if he can read from the machine's memory