Secure ajax calls in classic asp = session?

Question

I'm starting to call ASP and .NET web pages from within a classic asp application using Ajax, but I don't know how to make sure users are authorized to call the method.

Will classic asp pages called from client script retain the session variables of the caller?

Should I retrofit the ASP application to do session in the DB and use that value?

Answer 1

In classic ASP the session will persist until it expires. So yes, it can be called from a client script.

Classic ASP sessions are not compatible with .NET sessions.

That being said, the better solution is to use the DB for user security.