In reading his article, like Peter, I was amused to see that so many people had declared this task "impossible!" I am writing this example to give you another possibility for the impossible. This article differs from Peter's in that I will explain how to do the Session State transfer without involving the client, offering an additional level of security (yes, it's important) and automation.

To summarize, the logic would work as follows:

• ASP.NET function calls an ASP Classic page
• ASP Classic page dynamically builds an XML structure to represent the ASP Classic Session State contents
• ASP.NET loads the XML output, and loops through each element, creating ASP.NET Session variables

<title>ASPClassicSession.asp</title>
<%
' ASPClassicSession.asp will create the XML structure to be gobbled up by ASP.NET

'set the content type to be of type text/xml
response.ContentType = "text/xml"

'begin writing the xml structure
response.Write "<?xml version=""1.0"" ?>"
response.Write "<session>"

'loop through the session contents, writing each item as if it were an XML element
for each item in session.Contents
     response.Write "<" & item & ">" & session.Contents(item) & "</" & item & ">"
next

'end the xml structure
response.Write "</session>"
%>

using System.Xml;
using System.Text;
using System.Net;
using System.Net.Sockets;

...

private string RetrieveXML(string server, string page, System.Web.HttpRequest request)
{
     /**********************************************
     * Send the request
     **********************************************/

     //create socket
     IPHostEntry ipHostInfo = Dns.Resolve(server);
     IPAddress ipAddress = ipHostInfo.AddressList[0];
     IPEndPoint ipe = new IPEndPoint(ipAddress, 80);
     Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);

     //connect socket to server
     socket.Connect(ipe);

     //Create the request to send to the server
     string strRequest = "GET /" + page + " HTTP/1.1\r\n" +
          "Host: " + server + "\r\n" +
          "Connection: Close\r\n" +
          "Cookie: " + request.Headers["Cookie"] + "\r\n" +
          "User-Agent: " + request.Headers["User-Agent"] + "\r\n\r\n";

     //Convert send data to bytes
     Byte[] bytesSend = Encoding.ASCII.GetBytes(strRequest);

     //Send the data to the server
     socket.Send(bytesSend, bytesSend.Length, 0);

     /**********************************************
     * Receive the return data
     **********************************************/

     //Declare variables for data receipt
     byte[] bytes = new byte[256];
     int nBytes = 0;
     string receive = "";
     string xml = "";

     // The following will block until the page is transmitted.
     do
     {
          nBytes = socket.Receive(bytes, bytes.Length, 0);
          receive += Encoding.ASCII.GetString(bytes, 0, nBytes);
     }
     while (nBytes > 0);

     //We have the page data, but it includes the headers
     // Retrieve XML data from page response
     xml = receive.Substring(receive.IndexOf("<?xml"), receive.Length - receive.IndexOf("<?xml"));

     //Cleanup the socket
     socket.Shutdown(SocketShutdown.Both);
     socket.Close();

     //Return the data
     return xml;
}

public void TransferSession(System.Web.HttpRequest request, System.Web.SessionState.HttpSessionState session)
{
     //Clear the session contents to have a clean session - Optional
     session.RemoveAll();

     //Define the URL and page to load the Session XML from
     string XMLServer = request.ServerVariables["SERVER_NAME"];
     string XMLPage = "aspclassicsession.asp";

     //Define an XMLDocument to allow easy XML tree navigation
     XmlDocument doc = new XmlDocument();

     //Load the document from the reader
     doc.LoadXml(RetrieveXML(XMLServer, XMLPage, request));

     //Loop through the Session element's child nodes and set
     //each Session object
     foreach(XmlNode node in doc.FirstChild.NextSibling.ChildNodes)
     {
          session[node.Name.ToString()] = node.InnerText.ToString();
     }
}

Gathering the XML data is not as easy as it sounds. Since the call from the client browser is going to the server, the server is then making the request for the ASP Classic page to generate the XML. The ASP.NET application does not share your ASP Classic Session State. The relationship between your browser and IIS is dependent on specific headers being passed back and forth. In this example we have ASP.NET gather the headers from the client request, and create our own socket connection to the server using our customized headers to create the illusion that we are the client browser making the request. ASP Classic accepts the request and gladly returns the desired results.

With all applications, you must know your data. The current implementation of this solution will not handle objects or arrays. It would not be difficult to customize the solution to work with specific objects if you know how to detect and rebuild them.

Inherent security exists in that execution occurs on the server-side. A user cannot create their own form or edit post variables to choose a different User ID or security level to transfer to.

What if you don�t want your users to have the ability to request the XML feed and see their session variables? Simply identify servers, such as the ASP.NET web servers, that are allowed to request the file and authorize them on your page. A visual should shed some light on this. I will modify the ASP Classic code from above:

The ASP Classic code:

<title>ASPClassicSession.asp</title>
<%
' ASPClassicSession.asp will create the XML structure to be gobbled up by ASP.NET

'Modify the IP address to reflect your allowed server IP(s)
If request.servervariables("REMOTE_ADDR") = "127.0.0.1" then
     'Authorized

     'set the content type to be of type text/xml
     response.ContentType = "text/xml"

     'begin writing the xml structure
     response.Write "<?xml version=""1.0"" ?>"
     response.Write "<session>"

     'loop through the session contents, writing each item as if it were an XML element
     for each item in session.Contents
          response.Write "<" & item & ">" & session.Contents(item) & "</" & item & ">"
     next

     'end the xml structure
     response.Write "</session>"
else
     'Not Authorized

     response.write "You are not authorized to view this page"
     response.end
end if
%>