views:

721

answers:

5

Hi all,

I need to know how to access a session set by one website or web application in another web application.

For example I have logged in gmail.com in firefox tab and then I opened orkut.com in a different tab and here I don't have to log in.

I need to access or share same user session in two different web application in ASP.Net.

Please help.

+7  A: 

You cannot cross the app domain with built in asp.net session for good security reasons.

What you are looking for is a single sign on system. This means you'd only have to sign on once but you'd after switching between apps you might have to reload that app's session from db if it isn't there. This can be done as you have their identity from the sign on.

dove
+4  A: 

Unless your applications share the same domain (e.g. both on example.com, or one on a.example.com and another on b.example.com), cookies won't help you here. You need some session storage that's accessible by both your apps, e.g. in a database that both have access to (for example, that's how stackoverflow.com and serverfault.com do it).

However, you need to somehow find out, which user account/session on Site A corresponds to the same account on Site B; you only need to do this once (to continue with SO "associate your accounts").

Piskvor
+3  A: 

You can't access the same "session" from completely different servers.

From what you describe you just need to use the same login, e.g. you don't want to provide your credentials again. This is, as dove answered, done with a Single Sign On solution. The Wikipedia article contains a lot of useful links.

Usually you use a third party service (that you also can provide yourself, you don't need anybody for this) and some redirects between the different servers in order to get some kind of certification of the identity of the user.

Basically OpenID, e.g. used here on stackoverflow, is a solution to the same problem, though you usually don't have implicit login - you need to explicitly log in.

If you control both participating servers as well as the authenticating "third party" (which may in fact be part of one of the two servers) you should be able to provide some implicit login easily.

Be aware of possible privacy issues though, if the sites don't obviously belong together. People might feel alienated if you proactively shared their identity if they don't recognize that both servers belong to the same entity.

Olaf
+5  A: 

Please check a very good article from Code project Single sign-on across multiple applications in ASP.NET

Also check this thread from asp.net http://forums.asp.net/t/1023838.aspx?View=Flat

Hopefully these will help you alot.

Muhammad Akhtar
+1  A: 

To achieve the effect you are going after, you won't be able to do it via Sessions because each session is independent of one another and cannot access one's resources from the other. As others have stated, the closest thing you can use would be some sort of implementation of and authentication system like OpenID.

DotNetOpenAuth is a great place to start for looking for examples on how to implement this kind of system for an ASP.NET project.

jlech