Using Session across domains in ASP.NET 2.0

Question

We have a web application to which users login. The app keeps the login info in Session. The problem is that the same application resides on different domains, and sometimes there are links between the domains - one domain has a link to the other. In this case, after clicking the link, the user is in the other domain, and has to re-login. Our users do not like this situation, and so we are looking for a solution.

We are reluctant to use cookies because sometimes our users log in from a public computer, which doesn't allow cookies. We also considered keeping login data in the DB, but we prefere not to do that, because we don't want to add another access to the DB on every page load.

So is there a way to enable Session between a few domains? Or is there another solution that we haven't thought of?

Note: We are not using Active Directory for authentication, but a DB authentication.

Answer 1

As far as I know, it's not possible.

Once, when migrating from "classic" asp to .net we had more or less the same problem. The "classic" asp pages doesn't share session with new asp.net pages.

What we did was a page that "registered" the user in both "domains". When the user access a page, and the page verifies that he isn't autheticated, the new page asks to the old one if it was on it.

Of course that this method has a huge security problem, and we used it only during the migration period. Trying to make it more reliable, we checked, for instance, the referer of the page.

Just to help you: another problem with the DB aproach is that, imagine that the user closes the browser without hitting a close/exit button. The "session" will be active in the DB. Of course that you have ways of dealing with it, but it will increase the complexity.

Answer 2

I would use a database to share session between domains or different technologies like classic ASP, PHP or asp.net.

Your concern about the database hit on every page is valid, so I use an approach were normal in-memory session is used to store an authentication ticket for the each. Only if that session doesn't exist, the server-side code goes to the database.

More information about this approach can be found at 'Enhanced Asp.net session state'