<p>In a previous job we had a classic ASP application that no one wanted to migrate to ASP.NET.  The things that it did, it did very well.  </p>

<p>However there was some new functionality that needed to be added that just seemed best suited to ASP.NET.  The decision was made to allow the system to become a weird hybrid of ASP and ASP.NET.  </p>

<p>Our biggest sticking point was session management and we hacked together a solution to pass session values through form variables.  I've talked to others that handled this same problem through cookies.</p>

<p>Both methods seem a horrible kluge (in addition to being terribly insecure).  </p>

<p>Is there a better or cleaner way or is this just such a bad idea to begin with that discussion on the topic is pointless?</p>

I have had to deal with the same problem. In my case, I encrypted a key into a cookie and used the database for any other information.  I wrote the encryption in .NET and inter-op'd to decrypt the id on the ASP side.  There is some weirdness dealing with base-64 string in that ASP will not get the same string as .NET, so you may have to do as I did and rewrite the base-64 string to hex equivalent or some similar lowest-common-denominator tactic.  It is relatively secure (save a XSS attack).