Hi,

I am seeking an opinion on the following topic.

Briefly, my ASP.NET application has two pages (actually it has more but for this discussion two pages are sufficient)

The first page is a log in page where a user logs in. He/she enters his username and the password. The username and password is validated against a table in the DB and, if passed, the requester ID (PK) is stored in a session variable. E.g.

Session["UserPk"] = nUserId;

Then, next page is open where the user enters some order. After he/she fills out the order form, they click on Submit and the data is sent to the DB Stored Procedure. The Order form gets the nUserId from the session as follows:

nUserId = (int)Session["UserPk"];

The value of nUserId is sent to the Stored Procedure.

What I noticed (actually a customer brought to my attention) is that sometimes the value 0 for the variable nUserId is passed to the Stored Procedure. Which means that the Session variable didn't have any value. Or it expired. How, I don't understand.

This is why I asked yesterday on how to get the Authentication Mode. Now, I will check, in code, if the Authentication mode is Forms. Which means that nUserId must have a value greater than 0. And if the nUserId is 0, the program will not submit but show the error message. Something like, "Log out and log in again ..."

Does above seem like a good approach? Or should I replace the Session variable use with another approach?

TIA