How to share session between a MVC project and a WCF project?

Question

I have an angular-WebAPI-MVC-WCF solution.

I want to share the user session between the MVC and WCF projects. Is this possible?

Also, I want to share the authentication mechanism, I mean, I only want the user to be authenticated once on the MVC project using FormAuthentication, and let the WCF know when the user is authenticated without envolving any other technologie.

I have another solution where the MVC and WCF app reside on the same project(dll), and on that context I can share the authentication and session data.
So, in order to share the session, should I move the svc files from the WCF into the MVC project? Is that the only way?

All the projects share the same db, but I would like to solve this without having to store session data on the db level.

Thanks for any info

Answer 1

If your WCF layer is on the same app pool, you can check for the ASPXAuth cookie (Forms Auth cookie name which is configurable) and you can use methods in the FormsAuthentication class/namespace to decode the cookie to get the user in your WCF layer.

If you configure the forms auth cookie to be a domain cookie then you can host your WCF layer in a different app pool/iis site as long as it's on the same domain as your main site. Both sites will receive the cookie.

That cookie is what drives forms authentication. If the FormsAuthenticationModule sees the cookie in the request cookies collection it retrieves the user from the cookie (decrypts it) and creates an authenticated session.

Optionally, you could also create the cookie yourself by creating a log in method in your WCF layer and have it Create the Forms Cookie in the WCF site. However logging out of the main site would not log out the webservices so you'd have to call log out on the Web Services layer when a user logs out of the main site and vice versa.

If you configure the site to use Forms Auth in url mode you can authenticate without the cookie, but then you have to pass the FormsAuth ticket around in every single url...

As to sharing the session data, you can configure ASP.Net session state to be DB Based instead of Process based. In doing so ASP.Net will put your session data in the database for you, you do not need to do it yourself. https://support.microsoft.com/en-us/kb/317604#bookmark-3