Session based AES with random key and static salt I'm currently using aes to encrypt/decrypt messages to and from a web service.

When the user establishes a session he sends a random  generated secret via rsa public key.

This secret is used to establish a secure channel using AES (CBC).

I'm using Rfc2898 to derive a key with a static salt (the salt is hardcoded and never changes). The IV is randomly generated for each message and prepended in cleartext.

Is it ok to use a static salt (Since I'm using a random generated secret for each session)?
Currently you seem to be using a Password Based KDF (PBKDF); you are using PBKDF2, as defined in Rfc2898. You don't need to do this as randomly generated data is already fine for creating an AES key. So - as you don't need a PBKDF - you don't actually need a salt.

If you need more keys or key data then what is actually required is a Key Based KDF (KBKDF), as your shared secret already contains enough entropy. Passwords usually don't, that's why they require the key strengthening delivered by PBKDF (by using a salt and iteration count). HKDF doesn't require a salt either, but its security properties are significantly enhanced if you do provide a salt.

Note that CBC should not be used by itself to create a secure transport protocol. CBC does not provide integrity nor authenticity. And if error (padding) oracles apply - which is likely - then it doesn't even provide confidentiality, leaving you with nothing. You need to at least add a MAC - HMAC is preferred - and a MAC key. To generate two keys...see the second paragraph and provide two different labels (or "OtherInfo"), one for each key.