ProcessRequest ASHX called Twice Causes Session variable Loss

[voodooman]

hi

any help,advice,tips etc are greatly appreciated.

i've got an ashx page being called to handle the displaying of an Word doc. -

.NET 2.0, c#, running local on XP Pro

ProcessRequest------------

public void ProcessRequest(HttpContext context)
{
/*
try
{
*/
int userpk = Convert.ToInt32(context.Session["userpk"]);
string cvfilename = context.Request["cvfilename"];

byte[] cv = DAC.GetCVBlob(userpk);

//context.Response.ContentType = "vnd.ms-word";
context.Response.ContentType = "application/octet-stream";
// context.Response.AddHeader("Content-Disposition", cvfilename);
context.Response.ClearContent();
//context.Response.AddHeader("Content-Disposition", cvfilename);
context.Response.AddHeader("Content-Disposition", "inline;filename=" + cvfilename);
context.Response.BinaryWrite(cv);
context.Response.End();
/*
}
catch(Exception e)
{
context.Response.Write(e);
}
*/
}

Now when this runs all is well and i get a prompt asking me if I want to Open, Save, Cancel this doc.

I click Open and the ProcessRequest page is called again, only this time the Session is null like its been abondaned and the page bombs out.

Kind regards

Dean

[voodooman]

I know how to solve this by using a querystring instead of a session variable but i'd then have to encrypt or generate a random userpk at user creation stage for security purposes, 2 things I'd like to avoid. Has anybody got any suggestion please as to how i can continue to use the session variables in this handler?

Thanks

Dean

[kenobewan]

I believe that it is worth creating a secure application. Here is an article that may help:
Chapter 10 – Building Secure ASP.NET Pages and Controls