Michel:

I have the user login then I store his credentials to a session variable. On evey method call, I pass in his credentials. If he somehow bypasses the login screen, the userid parms will be empty and he is redirected back to login screen. Works well, but there is probaly a more elegent way to do it.

I looked into using an HTTP header, while I could get the VFP side to work based on your helpful article, I could not get the asp.net side to work. All the examples I could find of adding an HTTP header were using .net web services and no VFP web services.

Charlie