0

For some reasons, I'm overriding the authentication functionality and deal with it by my own DB tables.

The only problem I've got so far that I'm using the Session to store some data and it's null in some times when I use it in Global.ascx.

I've read some questions on SO like this and this, and actually I'm not gonna investigate in the potential reasons right now so I'm asking:

Is Session is the best cache state for my case? or I have to use something else like cookies?

Note: The stored data is the privileges for the user and some other data related to the user.

Community
  • 1
  • 1
Jose
  • 75
  • 3
  • 10

2 Answers2

1

From the moment you have your own DB tables for the authentication, its easy for you to make one more table for the session data and connect ether the authenticated user with that table, ether an anonymous user with.

What I say, is that you can give a unique cookie to every user of you, and then connect this cookie with his data on the new session table data, and from there you get your needed data.

The key points here is that you must clear the session table data every minute, the same way MS do when you use session data on database. Clear, I mean to delete the time out sessions.

And second to be sure that every user gets a unique encoded cookie.

In my application I use 2 diferent table for similar reason. One table for remember some options per user per computer, and one for some extra session data.

Aristos
  • 66,005
  • 16
  • 114
  • 150
  • Sorry, but this sounds like re-inventing the wheel (Session). Why would you want to do that ? – driis Jul 09 '11 at 16:33
  • @driis to have the full control. For example you can not access session state if you do not have the session handler, eg inside a stand alone thread. Also the sessions can not used as remembered options. Eg my users can save the options of drop down lists as default in the backoffice, or can remeber the last directory of. – Aristos Jul 09 '11 at 18:02
0

I would agree with John Saunders, have you considered using a Custom Membership Provider instead?

Implementing a Membership Provider

Inherit and implement/override as needed? To confirm with this you would still need to use Session or similar, but if you want the data to persist between sessions then use cookies. That said storing information like privileges/user permissions on the client sad can be an issue from a security point of view unless you are encrypting it somehow.

Pat Ramadass
  • 96
  • 3