ASP.Net: If I have the Session ID, Can I get the Session object?

Question

This question is related to this one, though I think I was a little too long-winded there to really get a good answer. I'll keep this brief.

I'm working on a web handler (ashx) that accepts a form post from an aspx page. When the handler receives this form post, in order to do what it needs to do, it needs to know the user who is logged in (User.Identity.Name), but I can't rely on cookies being sent by the browser.

I know I can get the Session.SessionID and place it in a hidden form field, but once my handler receives the form post, how can I use that SessionID to figure out the logged-in user's identity?

I'm using the StateServer mode for session state.

Answer 1

I think you can do it be implementing the IReadOnlySessionState interface on your HttpHandler

Answer 2

In an HttpHandler or HttpModule implementation, you cannot always access session from the BeginRequest event. There is another event you can handle, called OnAcquireRequestState. If you write your code in that event, then HttpContext.Current.Session will not be null.

Answer 3

Unless there is a need to use session directly, you could always store whatever information about the logged-in user's identity in a singleton dictionary or cache and reference it via the SessionID stored in a hidden field. I personally see security issues in this but won't go into those. I would consider issuing single use identities for this type of implementation.

Answer 4

Jonas posted a great answer to this question here:

http://stackoverflow.com/questions/43324/can-i-put-an-aspnet-session-id-in-a-hidden-form-field#237682