security for AJAX-style function calls

[PJ6]

I have AJAX-style calls that will require a user's login for permission
checks. I might have been OK with the login ID rolled into a session
variable, but now I'm faced with calling my AJAX functions with the login,
which would be pretty easy to hack.

I was thinking on a successful login attempt to issue a GUID to that session
and store it in a hashtable server-side with the login name, probably expire
it after 24 hours.

This seems pretty straightforward to do but I've had it drilled into me that
one does not 'home-brew' security, one uses whatever is commonly available
and accepted as secure. I just wanted to check here if this approach is OK.

Paul

 

[Bruce Barker]

not particularly secure, this is not much different than just using the
session id. if you need security, you should run over https, so sniffers can
not be used.

-- bruce (sqlwork.com)

 

[PJ6]

OK, thanks.

Paul