Apache – Cannot access SOAP service when Flex 3 app is compiled

Others may disagree, but I actually don't see a huge problem with handling it the way you are now; that's probably how I'd handle myself, at least initially. One way or another, even down the road, you'll probably want to keep the Flex app aware of the authentication state of the session, so if that means checking the ASP.NET session token directly, or some other cookie you set when you set that one, it seems like a fine and reliable way to go.

I do see what you mean about the services redirecting, but even so, with forms auth, it's not so much the service specifically that's handling the redirecting so much as the ASP.NET app itself. Later, should you need to use a different authentication scheme, you can consider that scheme's specific implementation considerations. Unless you've got concerns about using forms auth in general, there's probably no need complicate your approach simply because of the Flex client and Web services.

By default Flex does not allow accessing web services on remote hosts. This is a security feature of Flex. Since your Flex app is deployed at myapp.mysite.com it's under different host than the service at mysite.com.

You can add a crossdomain.xml to the mysite.com which Flex will check to see if the service allows access from different domains. The crossdomain.xml file must be located in the web root of the domain (mysite.com/crossdomain.xml). I've used the following contents to allow debugging use. Note that it allows all use so if you want to restrict the use in production, you need to modify it later.

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
    "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*" to-ports="*" />
   <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

More information in Flex documentation, especially the knowledge base article.