I have created an **HttpHandler** that I will be using with a **jquery-Ajax** call.

This **HttpHandler** will access the database and check something related to the **currently singed in user**.

The user is considered signed in by using the Session, with an attribute called **user\_id**.

```
Session["user_id"] = userId;

```

I tried to retrieve this **Session** in the **HttpHandler** but that doesn't seem to work.

So I thought about sending the user\_id as a **parameter**.

```
    var user_id = //Retrieved in some way...
    $.ajax({
        url: 'QuestionRate.ashx?id=user_id',
        success: function (msg, status, xhr) {
            alert(msg);
        },
        error: function () {
            alert(msg);
        }
    });

```

But this really seems like a bad idea, anyone who will read the codes can simply access the Handler with the id that he wants.

So what can I do in this situation? I want the Handler to get the user\_id for database access, yet I wanna make sure that this user\_id is the actual id of the signed in user. There's no way to access the Session in the Handler?