1

I have two applications, one on a primary domain and the other on another domain. One is a legacy site and the other is a new site. We are slowly converting the legacy site (4.0) using a mix of classic asp, .Net2 webforms, and MVC3 to the new site (4.5) which uses MVC4. It is not possible to convert the entire legacy site at this time.

The requirement is to seamlessly click a link on either site and transition to the other site. The user should not notice that site1 is not part of site2 and vice-versa. The authentication is a mix of windows auth behind a firewall dmz and external customer facing site using a custom login and SSL.

The user session and data must be shared in some way between app1 and app2. It is a government site so security is of the highest priority. This will also be in a load balanced environment running Windows Server 2012.

I am unsure of the approaches for the following:

  1. The best and most secure way to share these sessions. Appfabric on the Win2012, State Server, and SQL Server (I know AF can use this as a provider) are all fair game.

  2. How to transition the Browser UI Pages seamlessly. I thought about possibly using a master Unified UI menu with IFrames that loaded either App1 or App2. I feel that is not best or most secure method however. The prerequisite will be javascript enabled users only.

I have done research on this topic and looked at Appfabric session cache with the sharedid in the web config, but I am not sure if that is the preferable way to go or if that even meets part of my requirement.

Any assistance would be very much appreciated.

Thank you!

4

1 回答 1

1

是的，AppFabic 会话状态提供者可以轻松地在应用程序之间共享会话。默认情况下，缓存客户端和缓存集群之间发送的数据是经过加密和签名的。此外，缓存集群的任何客户端都必须通过Grant-CacheAllowedClientAccountcmdlet 专门添加到允许的客户端帐户列表中。从这个角度来看，它是安全的。

我有两个应用程序，一个在主域上，另一个在另一个域上。

这就是问题所在。复习基本会话概念总是有用的。作为会话状态提供程序，AppFabric 使用 SessionID 在分布式缓存中获取/存储会话内容（注意：所有提供程序都相同）。默认情况下，SessionID 值存储在 cookie 中。cookie 有一个范围 = 域（和路径）：它们告诉浏览器 cookie 应该只针对给定的域和路径发送回服务器。显然，将 cookie 从 domainA 发送到 domainB 是无用且不安全的。

在网站之间共享会话意味着您必须在网站之间共享 asp.net 会话 cookie。如果 siteA 托管在 domainA 上，而 siteB 托管在 domainB 上，这是不可能的（注意：如果有人有解决方案，我很感兴趣）。

于 2013-06-21T12:11:00.897 回答