Essentially I have a application that is 2 parts.
One part is on the user's machine, which will upload files to my server, and
the other part is a web application that works with those files.
Both of the Applications implement security protocols for Authentication/Authorization on their own using the same security framework, but I'm not sure if they actually share any Session data (not sure how I would find that out).
My question is.... if I added a WebView portion to the Main Application, would it be wise to make them log in again, since that's default functionality when going to the site?
Or, since they already logged in the main application, that there is no point in making them "log in again?"
To add further into the discussion, the Main Application is more of an admin control area, where you create your users, so that others can log in to those users on the web.
IF I were to have 1 login for both, would it be weird logging into the admin (main) and then wanting to view a user would log in itself through the main Application and forcing a login?
I figured I would post both scenarios, in case one would be different.
I assume that once you are in, it doesn't matter what happens. The user accounts cannot be edited from the web, just the main application, so in reality once you are logged into the main, there isn't much you could do by auto-logging into the web part.
I also am curious if I were to implement a password recovery for users, if it would make sense to allow changes to passwords in the application (without remembering the user password), or do a recovery process as if they were the admin. AS I said above, once you're logged into the Admin, all users are vulnerable to anything.
Thanks for any advice!