Transfer User ID between web apps

[Guest]

I have 2 asp.net applications : a Stock Control application and a Reporting
application. They are separate applications in IIS 6 and developed as
separate projects in visual studio.net.

When the user first goes into the Stock Control app, he needs to log in.
When he goes from the Stock Control app to the Reporting app, his User ID
needs to get transfered across so the Reporting app knows who the user is
(without asking him to log in again).

I don't want to use a querystring (because this will be visible), and the
session and cookies won't transfer across web applications.

How should I transfer the User ID from one application to another ?

Thanks,
Craig

 

[MattC]

Craig,

Could you not just use a temporary cookie?

I presume you want to hide the ID so that anyone who sees the ID cant just
URL hack their way into the reporting page.

MattC

 

[Guest]

If you save a cookie from one web app, can another web app access that cookie
(they are different webs in IIS 6). I didn't think you could, but if you can,
that solves my problem.

 

[MattC]

You got me on that one.

I was thinking of the coookie type that is written to the clients computer.
But I am unsure as to how that data is accessed, stored.

MattC

 

[Guest]

I do this with an encrypted URL. The URL consists of something like
x=1jhbsop4kgmr8r,spwkw...

I create a comma delimited string containing a date-time stamp and a userid.
I encrypt the string, URL-Encode the string equivalent of the encrypted text
and put it in the URL. The page receiving the special URL decrypts it and
uses the userid to authenticate the user. The date-time stamp is used to
"invalidate" the encrypted URL after an arbitrary amount of time. This
prevents someone from saving it and using it later in an unauthorized fashion.

Ideas abound....

 

[Guest]

thanks for the help, Brad -- great suggestion.