security for AJAX-style function calls

[PJ6]

I have AJAX-style calls that will require a user's login for permission
checks. I might have been OK with the login ID rolled into a session
variable, but now I'm faced with calling my AJAX functions with the login,
which would be pretty easy to hack.

I was thinking on a successful login attempt to issue a GUID to that session
and store it in a hashtable server-side with the login name, probably expire
it after 24 hours.

This seems pretty straightforward to do but I've had it drilled into me that
one does not 'home-brew' security, one uses whatever is commonly available
and accepted as secure. I just wanted to check here if this approach is OK.

Paul

[Bruce Barker]

not particularly secure, this is not much different than just using the
session id. if you need security, you should run over https, so sniffers can
not be used.

-- bruce (sqlwork.com)
"PJ6" <no****@nowhere.net> wrote in message
news:OP****************@TK2MSFTNGP11.phx.gbl...

I have AJAX-style calls that will require a user's login for permission
checks. I might have been OK with the login ID rolled into a session
variable, but now I'm faced with calling my AJAX functions with the login,
which would be pretty easy to hack.

I was thinking on a successful login attempt to issue a GUID to that
session and store it in a hashtable server-side with the login name,
probably expire it after 24 hours.

This seems pretty straightforward to do but I've had it drilled into me
that one does not 'home-brew' security, one uses whatever is commonly
available and accepted as secure. I just wanted to check here if this
approach is OK.

Paul

[PJ6]

OK, thanks.

Paul

"Bruce Barker" <br******************@safeco.com> wrote in message
news:%2****************@TK2MSFTNGP14.phx.gbl...

not particularly secure, this is not much different than just using the
session id. if you need security, you should run over https, so sniffers
can not be used.

-- bruce (sqlwork.com)