I’m starting to call ASP and .NET web pages from within a classic asp application using Ajax, but I don’t know how to make sure users are authorized to call the method.
Will classic asp pages called from client script retain the session variables of the caller?
Should I retrofit the ASP application to do session in the DB and use that value?
In classic ASP the session will persist until it expires. So yes, it can be called from a client script.
Classic ASP sessions are not compatible with .NET sessions.
That being said, the better solution is to use the DB for user security.