Silverlight/WCF login session

Question

I am working on a system with Silverlight and using WCF to call services to do all of the work on the server side.

I need to have a user log into the system, and once they are verified, all calls to the server need to contain the user info so the server can check security policies and do other operations based on the user.

What is the best way to do this? I can create some kind of a user class and send it to the server with every call, but is there a better way to do this with Silverlight and or WCF?

Answer 1

I would use standard token based approach. When you login to the server (by passing all required information through a user class as you suggested) the server will respond with a token. Every other server call will require a valid token. Server then validates that the token is still valid (it will automatically expire after some time) and that it comes from the same machine/user (you can check IP address for example).

This is probably the way I would implement that. You don't want to pass all the user information with every server call. (If you are on Intranet you might want to use impersonation or something like that.)