109
Views
4
Comments
Solved
Getting User Id by SessionId (From REST API)
Question

Hi. Is there is a way to get the user id based on the ASP.Net Session Id?

The reason for this question is this:

I have a web application that will use the platform's session model. On some web screens, I would like to make a manual XHR call to a REST API endpoint from the same eSpace. I do not intend to use screen actions. However, doing so means I will not be able to get the user id from my REST API. But I know that I can still get the session id by getting the ASP.Net_SessionId cookie. If I'm not wrong, this session id should help determine if the user has already logged into the application.

So basically, I want to leverage on this session Id instead of having to implement my own token authorization for my REST API endpoints.


I am open to other suggestions of how to get user id from the REST call.

mvp_badge
MVP
Rank: #39
Solution

Hi Enriel,

This is a very interesting question, and I spent some time writing a long winded post about sessions and the inner data model OutSystems uses to keep track of session data. I was pretty sure it wasn't possible, so I tried to think of ways to keep track of the relationship between session id and User id since I believe it's no longer explicitly exposed by the platform.

Then I looked into the PlatformRuntime_API extension and there's an action that does all of that...

I tested it out and Session_GetWebAppLoginInfo returns a UserId if you access a REST method from a screen while logged in, which sounds like what you need. I can't find any documentation on it so I'm not absolutely sure it will work in your manual XHR scenario.

mvp_badge
MVP
Rank: #39

No problem Enriel. Glad to know you got it sorted out!

Reading your question, I might still get some use of what I wrote before finding the right API. This is a good primer on the way OutSystems internally manages session data, but it was written in 2015 and I believe some things are no longer up to date.

From what I gather, there's no API to do this. Session data can be managed programatically, but there appears to be no way to select arbitrary session data from a specific user. Going by that thread, there's some interesting tables like ASPSTATETEMPSESSIONS:

But again, no clear way to link this to an actual User id. Going by a few old threads, it appears possible to gleam actual session variables from ASPSTATETEMPSESSIONSEXTVARS, but I can't make sense of the data. I suspect it's suffered some changes since 2015 and it's no longer that simple. Here's a query example if you're curious and want to look into it: