SessionStateAttribute with behavior of Disabled seems to not working?

Question

I've just known about Session State blocking, so I'm trying to test disabling that kind of blocking with a simple MVC project (the default when creating a new MVC project).

Here is the HomeController with the only involved About action method:

[SessionState(System.Web.SessionState.SessionStateBehavior.Disabled)]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
    static int c = 0;
    static long ci;
    [Authorize]
    public ActionResult About()
    {
        var isSecondRequest = ++c == 2;
        //Session["a"] = 1;
        Debug.Print(">>> Started working ..." + DateTime.Now);
        if (isSecondRequest)
        {
            Debug.Print(">>> current counter: " + ci);
            for (long i = 0; i < 10000000000; i++) ;
        }            
        else
        {
            for (ci = 0; ci < 10000000000; ci++) ;
        }
        Debug.Print(">>> Finished!");
        return Content("welcome");
    }

}

I test this by firstly opening two tabs of the home page. Then try clicking on About link on the first tab and almost immediately switch to the second tab to click on About one more time. So I expect the line >>> Started working … should be printed 2 times with timestamps almost the same or having a tiny difference of about 1 or 2 seconds, but the actual difference is up to 21 seconds, like this:

>>> Started working ...4/7/2019 3:16:15 PM
>>> Started working ...4/7/2019 3:16:36 PM

So that means the second request is still blocked, well that's unexpected when I've already applied the attribute SessionStateAttribute with behavior of Disabled to the HomeController. And really looks like it does work in another sense that the Session is null for each request.

Could you spot anything wrong here? My overall purpose is to disable this kind of blocking so that I can manually manage the concurrent requests and immediately return some helpful message (such as for the second request) to the client so that it's not looking like busy unnecessarily.

Answer 1

As per our chat, this is due to this being on the same controller and not actually directly related to session. When moving this to a separate controller the two requests do run at the same time:

public class SecondaryController : Controller
{
    // GET: Secondary
    public ActionResult Index()
    {
        Debug.Print(">>> Started working ..." + DateTime.Now);
        Thread.Sleep(10000);
        Debug.Print(">>> Finished!");
        return Content("welcome");
    }
}

Along with

[SessionState(System.Web.SessionState.SessionStateBehavior.ReadOnly)]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }


    public ActionResult About()
    {
        Debug.Print(">>> Started working ..." + DateTime.Now);
        Thread.Sleep(10000);
        Debug.Print(">>> Finished!");
        return Content("welcome");
    }

}

Is allowing me to do this just fine, showing the following output :

Started working ...4/7/2019 1:01:49 PM

Started working ...4/7/2019 1:01:52 PM

Finished!

Finished!

The following might be of interest here

"Here's the deal - IRouteHandler has one method - GetHttpHandler. When you make an ASP.Net MVC request to a controller, by default the routing engine handles the request by creating a new instance of MvcRouteHandler, which returns an MvcHandler. MvcHandler is an implementation of IHttpHandler which is marked with the (surprise!) IRequiresSessionState interface. This is why a normal request uses Session."

Taken from Disable Session state per-request in ASP.Net MVC

Answer 2

I'm really not sure, what you're doing wrong. I just created a completely new MVC application using VS2017. I took the HomeController and added the [SessionState(SessionStateBehavior.Disabled)] attribute. Then, I added the following code to the Index method:

public ActionResult Index()
{
    this.ViewBag.Start = DateTime.Now;
    System.Threading.Thread.Sleep(5000);
    this.ViewBag.End = DateTime.Now;
    return View();
}

In my view, I added:

<div class="row">
    <div class="col-xs-6">Start: @this.ViewBag.Start.ToString("HH:mm:ss.fffffff")</div>
    <div class="col-xs-6">End: @this.ViewBag.End.ToString("HH:mm:ss.fffffff")</div>
</div>

Now, I started up the application, opened two tabs, and loaded them simultaneously. The result was:

Tab1: Start: 21:10:41.3620017, End: 21:10:46.3623676
Tab2: Start: 21:10:42.4819327, End: 21:10:47.4824334

So, you can easily see, they ARE processing simultaneously.

I have had exactly this use case in various of my applications for a few years now, and it has been working fine. The [Authorize] also should not account for the serialized processing, as I do this in my applications, and I've never had problems there.

I also tried it with your code (with the for loop changed to Thread.Sleep) and Windows Authentication. It works as it should. In my other projects I typically use Forms authentication, and I've also never had problems with it. What authentication are you using?