An application stores sensitive values in session state. Which design principle is appropriate?

1. Extend every session indefinitely
2. Minimize sensitive state and apply suitable protection and session lifecycle controls
3. Store database administrator passwords in ordinary page items
4. Display all session values in public error pages