Re: Safest way to pass data between web apps?

From: Paul Glavich [MVP ASP.NET] (glav_at_aspalliane.com-NOSPAM)
Date: 03/14/05 

Date: Mon, 14 Mar 2005 16:50:59 +1100

Or simply a generated/custom session ID.

The less user specific info you can pass the better IMHO. A user ID is easy
to spoof. A GUID like session ID is much harder (in terms of relating it to
a set of information as its just an arbitrary ID/number).

>From your last email, it sounded like you had a common database. Anyways,
the most secure is using a certificate based approach I think. Use an
asymetric algorithm and the public key to encrypt the data, stuff it into a
form which you post to the receiving application, the receiving application
can decrypt with the private key after extracting the encrypted valies from
the form. 

-- 
- Paul Glavich
ASP.NET MVP
ASPInsider (www.aspinsiders.com)
"gaidar" <gaidar@vbstreets.ru> wrote in message
news:OWYWgyAKFHA.572@tk2msftngp13.phx.gbl...
> Hi, Paul,
>
> Yeah, but if there is a way to use one database. Anyway you should pass
user
> id between two web-applications.
>
> Gaidar
>
> "Paul Glavich [MVP ASP.NET]" <glav@aspalliane.com-NOSPAM> wrote in message
> news:eEN4CT7JFHA.3992@TK2MSFTNGP15.phx.gbl...
> >I dont think the DB is overkill at all. In fact, I think it is probably
the
> > most efficient, and safest method to do so. Its faster than reposting
the
> > data across to the other app and the "receiving" app can extract only
the
> > information it requires as need, as opposed to having to send all the
> > information, just in case the app requires it.
> >
> > -- 
> >
> > - Paul Glavich
> > ASP.NET MVP
> > ASPInsider (www.aspinsiders.com)
> >
> >
> > "J. Shane Kunkle" <shane@caudillweb.com> wrote in message
> > news:%23Cbt7nmJFHA.2704@tk2msftngp13.phx.gbl...
> >> I have an asp.net application that uses windows authentication. We need
> >> to
> >> loosely integrate another web application (written in cold fusion -
> >> hosted
> >> on another server) with my app (Loosely = provide a link to their app
and
> >> they will link to ours). Both systems use the same user information so
> > once
> >> they are authenticated by my app we would like to pass their
information
> > to
> >> the other app to avoid making users log in two (or more) times.
> >>
> >> Obviously these parameters rule out a few things (session, cache,
etc) -
> > we
> >> do share a database but this seems like overkill to me. As far as I
know
> >> server.transfer only works between web forms. My last resort is to use
> >> the
> >> query string with encrypted data - but I'm trying to avoid this for
> > obvious
> >> reasons.
> >>
> >> Any advice or direction is appreciated! Thanks in advance,
> >> J. Shane Kunkle
> >> jkunkle@vt.edu
> >>
> >>
> >
> >
>
>

Relevant Pages

  • Re: Session State across ASP.NET apps
    ... we are already using a central state server for all web ... so I knew about the encrypt decrypt thing for that. ... I'm just talking about sharing the session between apps. ... You can then grab the vars in the other app. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: ASP.NET Application - Defined???
    ... > gateway to the app). ... > business object into session state. ... > - Then Main.aspx did the bus obj user validation and filled out the rest ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Session State across ASP.NET apps
    ... For session variables, I have yet to have found a solution. ... You can then grab the vars in the other app. ... allow sharing of session vars, ... the web service would recognize the session ID, it could pass back the info. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Session timeout problem...
    ... During the login, in code behind I have dynamically created a public shared ... When the user clicks logout menu option from my app I also have code behind ... session will time out. ... ran some test code in the application start sub in global.ascx to log each ...
    (microsoft.public.dotnet.general)
  • Re: iperf: performance regression (was b44 driver problem?)
    ... this is the first such app and really, and even for this app: ... circumstances use up the whole CPU on high-res timers. ... One is receiving data and the other ... If the spinning thread doesn't yield, ...
    (Linux-Kernel)