VB.NET Web Application - Unwanted users session sharing

Question

I'm quite new to vb.net as I'm much more of a PHP developer but anyway. I've built a web application but my users seem to be sharing the same session which I do not want and can't understand why. I access the object which I store all session information in from a global property in a module, could this be the reason?

The code is as follows:

Module SiteWide
    Private mUserSession As New MyLib.User.UserSession
    Public Property gUserSession() As MyLib.User.UserSession
        Get
            If Not HttpContext.Current Is Nothing AndAlso Not HttpContext.Current.Session Is Nothing Then
                If Not HttpContext.Current.Session("user") Is Nothing Then
                    mUserSession = HttpContext.Current.Session("user")
                End If
            End If

            Return mUserSession 
        End Get
        Set(ByVal value As MyLib.User.UserSession)
            mUserSession = value

            If Not HttpContext.Current Is Nothing AndAlso Not HttpContext.Current.Session Is Nothing Then
                HttpContext.Current.Session("user") = value
            End If
        End Set
    End Property
End Module

Why are you using a static class(Module) as repository for your Session objects? Static means applications wide. `mUserSession` is also static implicitely, therefore all users share the same Session. — Tim Schmelter, Feb 17 '12 at 12:01
Ah... Like I said, new to vb.net. I just wanted a global (none static) way of accessing my session object rather than repeating the same checks and access all over the place. I was under the impression that a module was just globally accessible function storage space and not static. — James, Feb 17 '12 at 12:05

Tim Schmelter · Accepted Answer · 2012-02-17T12:21:59.873

Why are you using a static class(Module) as repository for your Session objects? Static means application wide. mUserSession is also static implicitely, therefore all users share the same Session. Actually the lines

mUserSession = value

and

mUserSession = HttpContext.Current.Session("user")

in the getter/setter are overwriting it for all users.

You could wrap the Session object in your own class just for simplification:

For example:

Public Class MySession
    ' private constructor
    Private Sub New()
    End Sub

    ' Gets the current session.
    Public Shared ReadOnly Property Current() As MySession
        Get
            Dim session As MySession = DirectCast(HttpContext.Current.Session("__MySession__"), MySession)
            If session Is Nothing Then
                session = New MySession()
                HttpContext.Current.Session("__MySession__") = session
            End If
            Return session
        End Get
    End Property

    ' **** add your session properties here, e.g like this:
    Public Property MyID() As Guid
        Get
            Return m_ID
        End Get
        Set(value As Guid)
            m_ID = value
        End Set
    End Property
    Private m_ID As Guid

    Public Property MyDate() As DateTime
        Get
            Return m_MyDate
        End Get
        Set(value As DateTime)
            m_MyDate = Value
        End Set
    End Property
    Private m_MyDate As DateTime

End Class

Note: The Current-property is also shared/static, but the difference is that i'm returning HttpContext.Current.Session whereas you are returning a single/shared instance.

Yes I considered this, as its similar to how I would have done it in PHP. Had I know about the static implications of a module I would have. Could I ask two further question (three if you count this one), why have you chosen to use DirectCast over CType? and could I convert gUserSession to return MySession.Current so I don't have to rewrite all my code or would the same problem apply? — James, Feb 17 '12 at 12:41
1.) http://stackoverflow.com/a/3056582 It's also recommendable to know the actual types involved, even if only for learning purposes ;) 2.) Just use my `Current` , rename it to `gUserSession` and rename `MySession` to `UserSession`. — Tim Schmelter, Feb 17 '12 at 12:49
@James: One final note: use Modules only for [Extensions](http://msdn.microsoft.com/en-us/library/bb384936.aspx). In 99.999% of other cases you should use (non-static)classes which might contain static members. — Tim Schmelter, Feb 17 '12 at 14:36

VB.NET Web Application - Unwanted users session sharing

1 Answers1