I have an asp.net web application in which i use several we services to serve several ajax requests. The problem is how to determine whether the corresponding call comes the page that i have served. I use forms authentication in my pages. Is there any way in which i can authorise the user calling the weservice through the same forms authentication.
This reminds me an old question I already answered to. Your scenario is different, but the root problem remains the same: if you call a web service from a Web Form, how to share authentication data with the form?
There is no simple and close-form solution to that. You can think about implementing WS-Security into the Web Service, and have the Web Form authenticate itself against the Web Service after checking that the user is authorized.
The Web Service won't share information about user login unless explicitly passed as parameter method (ie. void PerformAction(string userId, ...)
), but remember that in this case the perspective changes dramatically.
This is the best idea that comes into my mind, however, keep in mind that either you deeply redesign your web service or you are unable to let user-generated clients (ie. desktop applications compiled against your WSDL) to use your service.
[Add] now that you explained your scenario a little bit more detailed, here comes the exciting part of software engineering :)
As I said in my comment, you have multiple options, for example:
Application
collection) or, if webapp and web service are on different servers, use a DBMS; then, for each webapp's successful authentication, generate a unique token (session ID can be fine) and store it in a JS variable that will be passed to web service; finally, when web service is invoked, check against that shared object that the token is valid (ie. user is authenticated and still logged in, with permission to access that web service, so both authentication and authorization), otherwise reject