We have an application which has a session timeout of 20 minutes. However we have a requirement in which users must be able to access a certain page in the site for 8 hours after the original(20 minute) session was created. The page in question needs to use the session ID of the original session to pull saved session variables from the database which it can use to perform multiple features
- Storing the session ID in a cookie which has an expiry of 8 hours after the original session was created and using this to pull data from the database - I decided against this as it is not advised to store session ID's in cookies as someone could intercept it.
- Store the session ID in cache - same issue as above
- Create a new MVC application for the page with an 8 hour session in IIS and when user hits the link to go to the page, it will link to thew new application and it will create a new, separate session which lasts 8 hours - This is the current solution which the legacy Classic ASP application uses. I am hesitant to use this route as I think it is wasteful and time consuming and much more difficult to do in MVC than it is Classic ASP
Does anyone have any ideas to how this requirement can be met, securely?