Loss of session between classic ASP and ASP.NET
The company I work with is making the transition between classic ASP programs and ASP.NET programs for our intranet software. In the end, everything will be written in ASP.NET, but due to time constraints, there are still a number of programs that use classic ASP.
To compensate, we wrote functions that allow redirection and autologization between classic ASP programs and ASP.NET programs. However, I am starting to see an issue with persisting session state for our ASP.NET software. If a user is using an ASP.NET program, then they are running in a classic ASP.NET program and then returning to that ASP.NET program, often, user authentication for the ASP.NET program still exists, but the user session is lost, resulting in an error every time. when the function is executed inside the program.
I'm trying to capture the loss of session state in the global.asax event Session_End
, which redirects the user to the login page, but that didn't work. Has anyone faced a similar issue when users navigated between classic ASP and ASP.NET and lost sessions? Is this even my real problem? This is the only thing I see as a problem.
EDIT
This is what we do to redirect users to an ASP.NET page from a classic asp page.
We create an MD5 hash based on the user id and date and send it to the redirect.aspx page via a query string. From there, the aspx page creates its own MD5 based on the username and date, both passed through the query string. If the 2 hashes are identical, the user is authenticated and the program is loaded. Here's an example:
Classic ASP:
strDate = Year(Now()) & right("0" & Month(Now()), 2) & right("0" & Day(Now()), 2)
key = MD5(SessionUserID & strDate)
Response.Redirect "/redirect.aspx?key="&key&"&lpid="&ProgramID&"&unum="&SessionUserNum&"&uid="&SessionUserID&"&gid="&SessionGroupID
Redirect.aspx:
string key = Request.QueryString["key"];
//SetDesignModeState Variables:
if (getMd5Hash(Request.QueryString["uid"] + DateTime.Today.ToString("yyyyMMdd")) == key)
{
Session["SessionGroupID"] = Request.QueryString["gid"];
Session["SessionUserNum"] = Request.QueryString["unum"];
Session["SessionUserID"] = Request.QueryString["uid"];
string appID = Request.QueryString["lpid"];
FormsAuthentication.SetAuthCookie(Request.QueryString["uid"], false);
//redirect to ASP.NET page...
a source to share
I did something similar for you: authenticating users from an old ASP application to an ASP.NET site. Which would help if you could provide a little more detail (sample code, maybe) of the process you've set up to do this, with users from the legacy app to the ASPX app.
To give you a quick idea, in my implementation I did the following:
- Create an .ASPX page
- The .ASPX page only accepts HTTP POST values from a dedicated legacy ASP application.
- When a POST request is received, I retrieve the username and password values and then authenticate in the usual way. If the user is successfully authenticated, we send the FormsAuthentication cookie to the user.
In reality, my implementation is quite complex, using a database as a backup store (since both applications have a common data source) and a separate database field to store random code that is sent from the desktop application to the .NET side for further verification. that the request received by the .NET application is valid.
EDIT:
Try manually setting the cookie for authentication. Remove the line:
FormsAuthentication.SetAuthCookie(Request.QueryString["uid"], false);
Replaced by:
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
Request.QueryString["uid"],
DateTime.Now,
DateTime.Now.AddHours(24),
false,
null)
string encryptedTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
HttpContext.Current.Response.Cookies.Add(cookie);
See how you deal with this?
a source to share