My application utilizes a custom log-in system that generates an encrypted Token to signify a user's logged-in status. This Token is then passed to another page (Dash.aspx) via the QueryString parameter.
On Dash.aspx, the Token from the QueryString is extracted and stored in a hidden field using JavaScript. This Token is used for making web service calls, with the updated Token value being saved by JavaScript each time a call is completed.
Now, I am looking to create new pages that require a valid Token to be passed to them after the user logs in. The challenge is finding a more secure way than passing the Token via QueryString, while also ensuring that the Token remains up-to-date when navigating between pages.
I would like to avoid using Session to store and pass the Token if possible. Is there a more discreet way to pass the Token and consistently update it as needed?
This may be a broad question, but I believe there could be a solution out there that I'm not aware of yet.
Update:
Here's an example scenario:
Step 1: User logs in with username zholen and password zholen123
- A service validates the credentials and returns a Token 'ABC'
- User is redirected to Dash.aspx?token=ABC
Step 2: Dash.aspx retrieves the token from the query string and stores it in a hidden field
- JavaScript object saves the token internally
- Several asynchronous calls are made to different services, each returning an updated Token which replaces the old one (Tokens expire every 30 minutes)
Desired steps going forward:
Step 3: Transition from Dash.aspx to Account.aspx
- Account.aspx requires a valid Token to load
- More services are called to update the Token
Step 4: Return from Account.aspx to Dash.aspx with the most recent Token
Service calls can be done through a Web Service (asmx) or page methods depending on whether data retrieval is needed or not. Cookies have been suggested as a potential solution to update the Token, allowing C# to reset the cookie with the new Token during these calls and assuming async operations won't interfere.
The JavaScript object storing the Token internally could also place the updated value back into the hidden field for accessibility from the C# end.