Question

I’ve got a web service (ASP.NET 2.0) that I’m calling from javascript using jQuery’s $.ajax(). I’ve been told that the session key is often used as a nonce in a situation like this for security purposes; the web service takes a key as one of its parameters and only returns data if it matches the current session key.

I’m attempting to accomplish this by setting the value of a hidden field to the current SessionID on every Page_Load (i.e. every postback), then grabbing it in the javascript to pass as a parameter. But it’s never the same key as the web service’s current key (Context.Session.SessionID).

Is this possible to resolve, or should I be doing this another way?

EDIT: code to set session in hidden field as requested.

hfSession.Value = Context.Session.SessionID;

That’s in the Page_Load of a .ascx control, not under any conditional (i.e. not wrapped with if (!Page.IsPostBack).

Answer 1

Asp.net actually generates a new Session ID for every request until you use the Session State to store some value. This could be a reason why the values are different. Try and save something in the session. Perhaps

Session["SessionID"] = Context.Session.SessionID;
hfSession.Value = Context.Session.SessionID;