14

This question is related to this one, though I think I was a little too long-winded there to really get a good answer. I'll keep this brief.

I'm working on a web handler (ashx) that accepts a form post from an aspx page. When the handler receives this form post, in order to do what it needs to do, it needs to know the user who is logged in (User.Identity.Name), but I can't rely on cookies being sent by the browser.

I know I can get the Session.SessionID and place it in a hidden form field, but once my handler receives the form post, how can I use that SessionID to figure out the logged-in user's identity?

I'm using the StateServer mode for session state.

4 Answers 4

3

I think you can do it be implementing the IReadOnlySessionState interface on your HttpHandler

1
  • An excellent tip, but this still relies on the browser sending the ASP.NET_SessionId cookie, which I can't rely on. I need a way to manually pass the SessionId through to the handler. Sep 11, 2008 at 6:00
1

Unless there is a need to use session directly, you could always store whatever information about the logged-in user's identity in a singleton dictionary or cache and reference it via the SessionID stored in a hidden field. I personally see security issues in this but won't go into those. I would consider issuing single use identities for this type of implementation.

2
  • 1
    Good idea, but where to store this singleton dictionary? The Application object will not distribute to other web servers in the farm (or even other process threads in a web garden), sql database is an option, but I was hoping for something more elegant. Sep 11, 2008 at 6:03
  • SQL server would be your best bet. If you are using state server for this already, it would be a similar penalty. Or you could write your own WCF service that would handle this exchange. It could work as the unique ID broker as well as identity storage. Or even use a SQL endpoint service.
    – Adam Carr
    Sep 11, 2008 at 16:17
1

Jonas posted a great answer to this question here:

Can I put an ASP.Net session ID in a hidden form field?

2
0

In an HttpHandler or HttpModule implementation, you cannot always access session from the BeginRequest event. There is another event you can handle, called OnAcquireRequestState. If you write your code in that event, then HttpContext.Current.Session will not be null.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.