views:

98

answers:

2

In one web page we use a flash upload control but becouse a flash bug in the upload event the session is lost as its posted back with a new session.

We have tought of using a table with ip and old session id or a query string with the old session id in order to reassing it in the uploaded event...

Knowing the old session id how can i reassign it to the client? (In C#)

A: 

Does not work. The IP may hide many users - remember some people go throuh NAT devices sometimes involuntarily (their ISP enforces it, for example satellite providers), so you may have X users using the same IP.

TomTom
And passing the session id in the query string before the upload?
ase69s
That would work.
TomTom
Ok and the code to reassigning it would be??? :)
ase69s
see my update - it looks like it's something like HttpContext.Current.Request.Cookies.Add() or Cookies.Set() with the data you pull out of Request...
rohancragg
+1  A: 

For tracking the user identity:

URL (a unique token in the query string)? i.e. redirect each visitor to same page with their own token in the URL.

Cookies?

For tracking the associated data:

Perhaps then store this user-specific data in an application-level store (keyed on the user token as above) such as Application object. Of course you should be concerned about the lifetime of this data and should consider persisting it to disk or to a database instead.

UPDATE

This (from the swfupload project) looks suspiciously like a work-around for the issue described here...

Or you could just use that tool instead of your current upload control?...

rohancragg
The only problem i have is losing the relation between the user and its session becouse the flash bug. I have all the data i need using the asp.net session variables.
ase69s
it sounds like the control is making it's own request and has not been built to pass back the authentication cookie. I would look at catching the HTTP request early in the pipeline (an HTTPModule or some handling in Global.asax) and using some data in the query string to manually authenticate the request once you know what user it is.
rohancragg
Seems like you hit the point...gona test it, if works the check its yours... :)
ase69s
There is a problem...the request posted by the flash control omits the query string too... :S We are thinking about using Request.ServerVariables["REMOTE_HOST"] + Request.ServerVariables["LOGON_USER"] in a hashtable to recover its session id...But if someone knows a better aproach it would be preferred...
ase69s