We have a client/server app where the client is the browser running our JavaScript app and the server side is an ASP.NET app presenting a RESTful API.

We presently have 1 instance of the server, but we plan to put additional servers out so we have 1 each in the U.S., U.K., and Australia. It is unlikely we'll need to cluster though.

After the user logs in, on an https connection, what's the best way to verify that on subsequent requests it is the same person? Can we assign an object to the https session and safely assume that session remains that client user and they will stay tied to the particular server they logged in to?

Or do we need to do something additional?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.