Question

I have two webapplication, one is a simple authenticationsite which can authenticate the logged in user and redirects him then to another site.

Therefore I have to pass ther userId (GUID) to the second application. Currently this is done via the URL but i would like to hide this id.

Has anybody an idea how to do this properly?

[EDIT]: I can’t use the Session because of the ApplicationBoundaries (2 different Servers)

Answer 1

Pass the GUID through a session, best way.

http://www.w3schools.com/ASP/asp_sessions.asp

OR, since it’s 2 different servers, pass the information by POST method:

http://www.w3schools.com/aspnet/aspnet_forms.asp

The other possibility is to store the session state in a database on the local server, and remotely access that database from the other server to see if the user has successfully logged in and within session timelimit.

With that in mind, you can do the entire authentication remotely as well. Remotely connect to the local database from the remote server and check the login credentials from there…that way you will be able to store the session and/or cookie on the remote server.

I would recommend AGAINST the hidden field proposition, as it completely counteracts what you are trying to do! You are trying to hide the GUID in the URL but posting the same information in your HTML code! This is not the way to do it.

Best choice is the database option, or if not possible, then use HTTP POST.