I built a test web service project in VS2005 (vb) and I'm tring to
find if web service can modify SOAP Header variables and return them
to the client. My Web Service look like this:

Public Class MyHeader
 Inherits SoapHeader

 Public Username as String
 Public Password As String
 Public Token As String
End Class

Public Class Service
 Inherits System.Web.Services.WebService
 Public myHeadermemberVariables As MyHeader

 <WebMethod(Description:="Returns dataset", EnableSession:=true),
SoapHeader("myHeaderMemberVariable")>_
 Public Function GetData(ByVal sQuery As String, ByRef i As Int64,
ByRef sSessionID As String) As DataSet
   If (myHeaderMemberVariable.Username ="abcd") And
(myHeaderMemberVariable.Password="1234") Then
     'code which get data from SQL Server and populate custDS dataset
     i = custDS.Tables("myData").Rows.Count
     sSession = Session.SessionID
     myHeaderMemberVariable.Token = Session.SessionID.ToString
     Return custDS
   Else
     i = 0
     sSession = Session.SessionID
     myHeaderMemberVariable.Token = Session.SessionID.ToString
     Return Nothing
   End If
 End Function
End Class

All work fine, client is able to populate grid with received dataset
from this web service but SoapHeader Token variable as well as
sSession function parameter are both set to Nothing (they are not
populated with SessionID). My Problem is that I received very loose
specs to develop web service which will be working in the following
maner:
1. Client Login with Username & Password. Based on these information
user is authenticated and WS generates unique Token which is persisted
in SQL Server database and then send back to client.
2. Client uses this token every time client process calls WS
functions.
3. WS authorized client request base on last token, perform request
and generates a new token which is then return to the client in SOAP
header.
4. This process is repeated on every client request till client issue
Logout request.

I thought that most logical place to have tokens located is a SOAP
header, this would seperate authentication/authorization data from
each function parameter list and return variable. I wonder if anybody
tried something like this and would like to share some inside on
implementation of this concept. Any help and comments are greatly
apreciated.

Thanks a lot.