Hi all,
I have a web app secured by forms-auth & membership.
Secured
pages use client-side technology (jquery) in order to access a web
service (asmx or svc, using JSON) which is in the secured part of the
app (I don't want it to be open since it has data manipulation methods).
My questions are:
1.
How should the web service be secured in this scenario? is it ok to
simply leave it under the secured folder (which is actually the root of
this app)?
2. Is the auth cookie sent somehow with each AJAX request from the pages?
3. Can my WS have access to the session&identity of logged in requesting user?
4. What kind of response will I get (to my AJAX JSON calls) when session expires?
I have been researching for these issues for a while, but couldn't find a full solution yet, only bits & pieces so far...
Thanks
MK
...
Go to the complete details ...