title: Security and authentication methods I use
body: <p>I am not a programmer, but for some reason I do program here at work to do some apps that makes out job easier.  Anyway, this "some apps" has grown bigger in years. I've always had problems in understanding security or authentication related things, so I do it my way (which is indeed way way way far from being right). I use C#, mostly with client/server apps using WCF.</p>
  
  <p>The issue now is in my methods in WCF.  All of them are similar to this:</p>
  
  <pre><code>public Employee AddEmployee(Guid sessionID, Employee emp)
  {
      Session session = Common.CheckSession(sessionID);
  
      // do stuff
   }
  </code></pre>
  
  <p>As you can see, the sessionID is passed to every call to the WCF.  This ID is generated once the user login using another WCF method.  A row in the database is created and the 'CheckSession', which is called in every single method checks if the session is valid and if the user is allowed and so on. The connection is secured using SSL. </p>
  
  <p>How wrong is this?  Can I just keep do it for now?  Or should I just stop it because it is so messed up, and start figuring out the right way of doing it?</p>