services within same app do not see same session

Question

I have a solution with two projects in it. One project holds a number of WCF services that handle the data-access layer for my application - a service to deal with Building data, another for Room data, another for user data, etc. The other project is the actual application that consumes those services. When I deploy these two projects to the server, I deploy them as two separate applications, in separate folders, under the same site.

When the user logs into the application, I set a session variable with information about the user (rooms they "own", and favorite rooms, buildings, and calendars). So, any page within my application can see that information.

My problem is that my services cannot see that session variable. I have read a number of SO answers, and I gather that being that I have my services as a separate application, they use a different session, so I cannot expect them to see that session variable. I also gather that I have to use ASP.NET compatibility mode to cause the services to maintain a session, so I painted my service classes with the relevant attribute

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]

And made sure my config already had this mode enabled

<serviceHostingEnvironment aspNetCompatibilityEnabled="true"/>

And in my user data service, I added a method so that the front end application could pass this user information for the logged in user to the service, as well as a static property that stores the information in a session variable.

    public void SetCurrentUser(User thisUser) {
        CurrentUser = thisUser;
    }

    public static User CurrentUser
    {
        get
        {
            return (User) HttpContext.Current.Session["CurrentUser"];
        }
        set
        {
            HttpContext.Current.Session["CurrentUser"] = value;
        }
    }

When the user logs in, the front end application stores the relevant information in its own session variable, and also calls this method to tell the user data service to store it in its session variable (since I could not get the user service to see the session variables from the front end app). From the user service, I can then see that property all day long. Across multiple requests from the front end application to the user data service, the service appears to maintain the same session, preserving that information.

My problem is that when I try to access that from any of the other services within the data services application/project, I get zilch, nada, or more correctly - null. In my buildings data service, as a test, I put a simple statement that says

Room[] CurrentUserOwnedRooms = User.CurrentUser.OwnedRooms;

But it fails because CurrentUser is null. It's behaving as if the Building data service has a separate session that has no session variables set at all. When I stop execution in the building data service and examine the contents of HttpContext.Current.Session, it has nothing. While the user data service, whenever I call it, continues to show the one session variable that was set in it. This, even though both services are in the same application/project.

What am I missing?

Answer 1

Have you seen this post?

Sharing sessions across applications using the ASP.NET Session State Service

You can share session state across applications at the database level.

There is also a good article here that outlines how to use MySQL as a Session State Provider

Answer 2

ASP.NET supports customizable Session State Providers and provides 3 standard ones:

• InProcSessionStateStore, which stores session state in memory in the ASP.NET worker process
• OutOfProcSessionStateStore, which stores session state in memory in an external state server process
• SqlSessionStateStore, which stores session state in Microsoft SQL Server and Microsoft SQL Server Express databases

Although you can roll out your own custom one this might be non trivial. The only one of those 3 that is guaranteed to work correctly with several concurrent users (applications or servers) is the SqlSessionStateStore. Luckily it supports Microsoft SQL Server Express Edition which is free with some limitations but those should be not relevant for storing only session of a small Web app.

Still the storage originally is intended to be used with different servers in Web-farms rather than to share session between different apps and thus requires additional cheat to make it support session sharing between apps. The cheat is described at toddca MSDN blog and essentially involves changing TempGetAppID stored procedure to always return the same appId for different application names and thus enabling the sharing.

You also might be interested in a MSDN suggestion on how to Share Authentication Tickets Across Applications