How Can Get Session With SessionId?

Question

I use ASP.NET MVC. I have a problem. I set my variables to the session and I request a web service that doesn't belong to me. Then the web service makes an HttpPost request to my server. It doesn't send a cookie to my server so I lost my session.

I think I can save my sessionid to the DB and I can get back my session with this ID. But I can't get any solution.

What's your suggestion?

public ActionResult SomeAction(){
    mySettingService.saveSessionIdToDb(someToken, Session.SessionID);

    var myPaymentFormObj = FormInit.Create(request, options);
    myPaymentFormObj.DoRequest(); //it's callback to my another action with a token
}


[HttpPost]
public ActionView MyCallBack(string someToken){
    //here is our app generates new session id and i lost my session because other server doesn't send me session id.
    //i need to read session id from db and i can get my session maybe.

    var mySessionId = mySettingService.getSessionIdFromDb(someToken);

    //how can i start session like this?
    Session.SessionID = mySessionId;
}

Answer 1

It seems like the problem you described is about maintaining the distributed transaction. To describe it better your app is a service A and the webServer is service B. You can perform an action which saves some changes to the database A including the session stuff then you send a call to service B which also can saves some changes to its DB or perform a bunch of other actions but in this case you don't care how it works, you only care about what kind of responses you get back with a callback. There should be an option to be able to send some kind of unique thing like userEmail or a transactionId which you can get back in a callback method to be able to recognize the transaction.

What I would suggest you do is something like

[HttpPost]
public ActionResult SendBlah(BlahData data){
    var transactionId = Guid.NetGuid();
    _sessionService.Create(transactionId, dataYouWantToStore)
    _webServiceB.SendBlah(transactionId, data, token);
    //optionally return info about call status / do other stuff
}

//or this can be of type HttpGet
[HttpPost]
public ActionView MyCallBack(string someToken, string tranactionId){
    var sessionData = _sessionService.Get(tranactionId) 
    //do other stuff
}

If it's needed and you are using eg JWT you can store the transactionId/emailAddress/etc. there instead and read it. Btw. it's always safer to store the session in the database instead of using some cache objects or relaying on cookies or javascript objects etc. Also, it's better to be careful with the amount of data you want to store in a Session table in your db. I'd personally focus on storing the Ids and stuff like Status of given item etc.