Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Retaining session state during postback from another domain

$
0
0

We have an ASP.NET WebForms (designed for mobile) application that, as one of the functions, posts images to our back-end DB. This works without any problems with Windows Phone and Android and posts directly to the DB. With the iPain (iPhone and iPad) we can't post directly to the DB but have to use a third party app that uploads the image and then posts back to our server. To ensure that the session state is preserved we capture this as

Dim vSession As HttpSessionState = HttpContext.Current.Session 
Dim vSessionID As String = vSession.SessionID

and this is then sent as part of the upload string

 vURL += "cookies=ASP.NET_SessionId=" & vSessionID & ";CurrentHOA=" & CurrentCustomerValues & "&"

and returned as cookies, but users are getting kicked out of the secure section and back to the login page as soon as the image saving process is complete.

We are using forms authentication for the secure section - the postback from the third party app ( aurigma.com/aurigma-up/developer/api-code-designer ) is sent to a non-secure section (but still maintaining https) where the session should be restored and the user redirected to the start page in the secure section again.

At first we were having problems with the POST not returning, but turned out to be a FriendlyURL issue (we were posting to OurPage.aspx instead of OurPage and the POST string was empty).

Any help in diagnosing this would be appreciated.

Thanks


Viewing all articles
Browse latest Browse all 4737

Trending Articles