Search code examples
asp.netasmx

asp web service: check if user is logged-in

I'm creating a web service that'll be called from a web form in asp.net. How does the web service check if the user is logged-in and if it is the logged-in user that's actually requesting the service?

thanks

Solution

  • It cannot. Since you're going to call the web service from ASP.NET, you're building a 3-tier application.

    Tier 1 is the browser and tier 2 is ASP.NET web application. They share cookies and session variables, so ASP.NET can always authenticate the user. And you already know that.

    Tier 3 is the web service. Communication between 2 and 3 is done over a different HTTP connection, sharing different cookies (actually none) and session variables (again, actually none because calls are stateless).

    You then have no way to allow the web service on tier 3 to authenticate the client on tier 1.

    HOWEVER...............

    There is still a possibility, but only if your web service is local to your ASP.NET webapp. That's unlikely to occur, really, because web services are made for remote calls, not local calls. I don't think it's your case.