Accessing Session Using ASP.NET Web API

Question

I realize session and REST don't exactly go hand in hand but is it not possible to access session state using the new Web API? HttpContext.Current.Session is always null.

`[SessionState(SessionStateBehavior.Required)]` on the `ApiController` does the trick (or `.ReadOnly` where appropriate). — Roman Starkov, Mar 26 '18 at 21:20
@RomanStarkov Couldn't get this to work. What environment were you using? .NET Core? — Bondolin, Feb 27 '19 at 13:01
@Bondolin [SessionStateAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.web.mvc.sessionstateattribute?view=aspnet-mvc-5.2) and yes, MVC. — Roman Starkov, Mar 06 '19 at 21:09
Why not using a distributed cache? i.e. Redis is very good at this. — Edi, Jun 04 '20 at 13:50
@RomanStarkov the SessionState is for mvc controllers only. It doesn't work for the Web Api controllers. — boggy, Jan 07 '23 at 01:47

Rocklan · Accepted Answer · 2018-01-19T01:01:43.907

MVC

For an MVC project make the following changes (WebForms and Dot Net Core answer down below):

WebApiConfig.cs

public static class WebApiConfig
{
    public static string UrlPrefix         { get { return "api"; } }
    public static string UrlPrefixRelative { get { return "~/api"; } }

    public static void Register(HttpConfiguration config)
    {
        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: WebApiConfig.UrlPrefix + "/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
    }
}

Global.asax.cs

public class MvcApplication : System.Web.HttpApplication
{
    ...

    protected void Application_PostAuthorizeRequest()
    {
        if (IsWebApiRequest())
        {
            HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
        }
    }

    private bool IsWebApiRequest()
    {
        return HttpContext.Current.Request.AppRelativeCurrentExecutionFilePath.StartsWith(WebApiConfig.UrlPrefixRelative);
    }

}

This solution has the added bonus that we can fetch the base URL in javascript for making the AJAX calls:

_Layout.cshtml

<body>
    @RenderBody()

    <script type="text/javascript">
        var apiBaseUrl = '@Url.Content(ProjectNameSpace.WebApiConfig.UrlPrefixRelative)';
    </script>

    @RenderSection("scripts", required: false)

and then within our Javascript files/code we can make our webapi calls that can access the session:

$.getJSON(apiBaseUrl + '/MyApi')
   .done(function (data) {
       alert('session data received: ' + data.whatever);
   })
);

WebForms

Do the above but change the WebApiConfig.Register function to take a RouteCollection instead:

public static void Register(RouteCollection routes)
{
    routes.MapHttpRoute(
        name: "DefaultApi",
        routeTemplate: WebApiConfig.UrlPrefix + "/{controller}/{id}",
        defaults: new { id = RouteParameter.Optional }
    );
}

And then call the following in Application_Start:

WebApiConfig.Register(RouteTable.Routes);

Dot Net Core

Add the Microsoft.AspNetCore.Session NuGet package and then make the following code changes:

Startup.cs

Call the AddDistributedMemoryCache and AddSession methods on the services object within the ConfigureServices function:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();
    ...

    services.AddDistributedMemoryCache();
    services.AddSession();

and in the Configure function add a call to UseSession:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, 
ILoggerFactory loggerFactory)
{
    app.UseSession();
    app.UseMvc();

SessionController.cs

Within your controller, add a using statement at the top:

using Microsoft.AspNetCore.Http;

and then use the HttpContext.Session object within your code like so:

    [HttpGet("set/{data}")]
    public IActionResult setsession(string data)
    {
        HttpContext.Session.SetString("keyname", data);
        return Ok("session data set");
    }

    [HttpGet("get")]
    public IActionResult getsessiondata()
    {
        var sessionData = HttpContext.Session.GetString("keyname");
        return Ok(sessionData);
    }

you should now be able to hit:

http://localhost:1234/api/session/set/thisissomedata

and then going to this URL will pull it out:

http://localhost:1234/api/session/get

Plenty more info on accessing session data within dot net core here: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/app-state

Performance Concerns

Read Simon Weaver's answer below regarding performance. If you're accessing session data inside a WebApi project it can have very serious performance consequence - I have seen ASP.NET enforce a 200ms delay for concurrent requests. This could add up and become disastrous if you have many concurrent requests.

Security Concerns

Make sure you are locking down resources per user - an authenticated user shouldn't be able to retrieve data from your WebApi that they don't have access to.

Read Microsoft's article on Authentication and Authorization in ASP.NET Web API - https://www.asp.net/web-api/overview/security/authentication-and-authorization-in-aspnet-web-api

Read Microsoft's article on avoiding Cross-Site Request Forgery hack attacks. (In short, check out the AntiForgery.Validate method) - https://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

I got the error in the template RIS does not exist. I'm an extreme n00b and didnt realize you should replace that with your project name, if anyone else runs into that — Jameo, Aug 29 '13 at 19:28
Sorry about that Jameo, I've updated it to say ProjectNameSpace so it should be a bit more obvious. — Rocklan, Aug 30 '13 at 01:47
Perfect. Simple and it works. For non-MVC, just add Application_PostAuthorizeRequest() to Global.ascx.cs. — mhenry1384, Apr 10 '14 at 19:12
Please see my answer below, it extends your solution to also send the session cookie as part of the response when a new session is created. I had to implement it because when using the WebApi the cookie was read but no request was sending initially back. — JCallico, Apr 29 '14 at 20:52
Thanks @JCallico, I guess that most people hit the ASP.NET page first which creates the session. — Rocklan, May 02 '14 at 00:05
I needed to modify IsWebApiRequest() to also return true where path starts with WebApiConfig.UrlPrefix, as well as WebApiConfig.UrlPrefixRelative. Other than that, works as expected. — gbro3n, Jan 14 '15 at 09:14
Is this the recommended way of doing this? Is this merely a substitute for Session, or does it maintain the session from any page calling the web API? Is that even possible? — muttley91, Aug 18 '15 at 20:22
Here session expires in default 20 minutes.. I can't override through web config — Jeeva J, Sep 07 '15 at 06:21
One thing to mention regarding this fix. when setting the SessionStateBehavior to Required, you are bottlenecking the webapi, because all your requests will run syncronized due to locks on the session object. You could instead run it as SessionStateBehavior.Readonly. This way it will not create locks on the session object. — Michael Kire Hansen, Oct 02 '15 at 07:57
Just a note: SessionId is not the same, it changes on every refresh, don't think your session isn't shared with your mvc app. :) — CularBytes, Nov 29 '15 at 22:48
Be careful when setting the session state behavior to "Required". Requests with write permissions will lock the session and prevent multiple HttpApplications to be spawned per client. You should set the session state to an appropriate level for each route. Please refer to my answer here: http://stackoverflow.com/a/34727708/1412787 — Axel Wilczek, Jan 11 '16 at 17:42
I am not sure I understand. I don't use sessions in my Web.API 2, which means calls are always concurrent. In this case what is the point of using async in the controller action, since each request gets delegated to other thread to execute in the first place? — Mariusz, Apr 05 '16 at 10:00
Regarding the session state synchronization bottlenecks: One should nearly always replace the default session state provider with a non-blocking session state provider. There are multiple solutions available. They should replace the existing session state provider at the module level. The Angie's List provider is good, but swap out the BootSleeve library with StackExchange's Redis provider. People overgeneralize in saying one should avoid state, but think of it as a secure form of caching. — DaveMorganTexas, Jul 17 '16 at 03:12
Session is still null when I use this. Any idea why? Attempting to set a breakpoint inside Application_PostAuthorizeRequest causes a null reference exception to be thrown when loading any page. — marknuzz, Jul 23 '16 at 05:05
http://ft.trillian.im/30a23cd835c1a6834bcb6c7b2740649b0f2aaf28/6JcYKR08NKPC41jK3MJgdKhiOfJyr.jpg — marknuzz, Jul 23 '16 at 05:10
Method MUST be named Application_PostAuthorizeRequest() or the above error will occur. — marknuzz, Jul 23 '16 at 05:22
Hey all, how can I set [SessionState(SessionStateBehavior.ReadOnly)] on my Dot net Core? — Paula Fleck, Oct 15 '21 at 12:48

score 66 · Answer 2 · edited Apr 21 '13 at 11:57

66

You can access session state using a custom RouteHandler.

// In global.asax
public class MvcApp : System.Web.HttpApplication
{
    public static void RegisterRoutes(RouteCollection routes)
    {
        var route = routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
        route.RouteHandler = new MyHttpControllerRouteHandler();
    }
}

// Create two new classes
public class MyHttpControllerHandler
    : HttpControllerHandler, IRequiresSessionState
{
    public MyHttpControllerHandler(RouteData routeData) : base(routeData)
    { }
}
public class MyHttpControllerRouteHandler : HttpControllerRouteHandler
{
    protected override IHttpHandler GetHttpHandler(
        RequestContext requestContext)
    {
        return new MyHttpControllerHandler(requestContext.RouteData);
    }
}

// Now Session is visible in your Web API
public class ValuesController : ApiController
{
    public string Get(string input)
    {
        var session = HttpContext.Current.Session;
        if (session != null)
        {
            if (session["Time"] == null)
                session["Time"] = DateTime.Now;
            return "Session Time: " + session["Time"] + input;
        }
        return "Session is not availabe" + input;
    }
}

Found here: http://techhasnoboundary.blogspot.com/2012/03/mvc-4-web-api-access-session.html

edited Apr 21 '13 at 11:57

Owen Blacker

4,117
2
33
70

answered Dec 07 '12 at 07:17

warrickh

1,616
1
16
14

14

Update: if your API functions read from session, and don't modify session, it might be a good idea to use IReadOnlySessionState instead of IRequiresSessionState. This ensures the session isn't locked during the processing of the API function. – warrickh Jun 09 '13 at 20:48
6

not working for me in MVC 4 - route.RouteHandler is not even a property for me. @LachlanB seems to have what worked for me. – bkwdesign Aug 26 '13 at 19:15
3

Thanks @bkwdesign for pointing out the MVC solution. This answer relates to Web API only. – warrickh Aug 26 '13 at 23:55
2

This doesn't seem to support Route Attributes. Thoughts? – Tim S Nov 06 '15 at 19:14
As bkwdesign pointed out, this is no longer supported. However, there is a way to define the session state behavior per route using DataTokens: http://stackoverflow.com/a/34727708/1412787 – Axel Wilczek Jan 11 '16 at 17:44
@AxelWilczek, the problem with bkwdesign's method is that it relies on Application_PostAuthorizeRequest. If you're on a large project consisting of many pages, handlers, and web api methods each page will go through that method. Tim you're right this doesn't support attribute routing. I'm hoping to find a solution. – Ryan Kara Jan 13 '17 at 21:21
Hey all, how can I set [SessionState(SessionStateBehavior.ReadOnly)] on my Dot net Core? – Paula Fleck Oct 15 '21 at 12:47

score 52 · Answer 3 · edited Jun 20 '20 at 09:12

Why to avoid using Session in WebAPI?

Performance, performance, performance!

There's a very good, and often overlooked reason why you shouldn't be using Session in WebAPI at all.

The way ASP.NET works when Session is in use is to serialize all requests received from a single client. Now I'm not talking about object serialization - but running them in the order received and waiting for each to complete before running the next. This is to avoid nasty thread / race conditions if two requests each try to access Session simultaneously.

Concurrent Requests and Session State

Access to ASP.NET session state is exclusive per session, which means that if two different users make concurrent requests, access to each separate session is granted concurrently. However, if two concurrent requests are made for the same session (by using the same SessionID value), the first request gets exclusive access to the session information. The second request executes only after the first request is finished. (The second session can also get access if the exclusive lock on the information is freed because the first request exceeds the lock time-out.) If the EnableSessionState value in the @ Page directive is set to ReadOnly, a request for the read-only session information does not result in an exclusive lock on the session data. However, read-only requests for session data might still have to wait for a lock set by a read-write request for session data to clear.

So what does this mean for Web API? If you have an application running many AJAX requests then only ONE is going to be able to run at a time. If you have a slower request then it will block all others from that client until it is complete. In some applications this could lead to very noticeably sluggish performance.

So you should probably use an MVC controller if you absolutely need something from the users session and avoid the unncesessary performance penalty of enabling it for WebApi.

You can easily test this out for yourself by just putting Thread.Sleep(5000) in a WebAPI method and enable Session. Run 5 requests to it and they will take a total of 25 seconds to complete. Without Session they'll take a total of just over 5 seconds.

(This same reasoning applies to SignalR).

You can get around this by using [SessionState(SessionStateBehavior.ReadOnly)] if your method only reads from the session. — Rocklan, Jul 15 '15 at 04:57
For your scenario of 5 concurrent requests, i am blocking the UI on the first request and not allowing them to create multiple requests until the last one ends. If i don't user session key, how will i authenticate the user if i am creating the web api for a mobile app? — Ali123, Dec 18 '20 at 19:36

score 22 · Answer 4 · edited Mar 07 '12 at 23:32

22

Well you're right, REST is stateless. If you use a session the processing will become stateful, subsequent requests will be able to use state (from a session).

In order for a session to be rehydrated, you'll need to supply a key to associate the state. In a normal asp.net application that key is supplied by using a cookie (cookie-sessions) or url parameter (cookieless sessions).

If you need a session forget rest, sessions are irrelevant in REST based designs. If you need a session for validation then use a token or authorise by IP addresses.

edited Mar 07 '12 at 23:32

Antony Scott

21,690
12
62
94

answered Mar 07 '12 at 01:10

Nickz

1,880
17
35

10

I'm not sure about this. In Microsoft's examples they show using the Authorize attribute. I've tried that and it works with Forms Based Authentication. The Web API is aware of the authentication state which is being passed in the default authentication cookie. – Mark Mar 07 '12 at 01:18
4

Here is the sample I'm referring to, http://code.msdn.microsoft.com/ASPNET-Web-API-JavaScript-d0d64dd7 . It uses the new REST based Web API implements Forms Authentication. – Mark Mar 07 '12 at 01:24
5

I've used the [Authorize] attribute successfully without needing session state. I just wrote an authentication message handler to set the identity. – Antony Scott Mar 07 '12 at 23:34
1

As @Filip said here: http://stackoverflow.com/a/11479021/538387 , let's do not follow this path (adding session to Web API which is supposed to be stateless). But the same Filip has a good article about Web API Caching: goo.gl/2rnfI I forked him in gitHub and add a few more functionality to the source code, now it supports separated output cache for logged-in users: goo.gl/oW4hX NOTE: I'm still improving the code and test it for any possible security breach. – Tohid Dec 28 '12 at 15:29
@MarkS. and Antony Scott - ASP.NET Authentication data comes in a cookie. Cookies are not violating RESTful stateless principle - as far as I know. Also be aware that [Authorize] only works when the web page and Web API are in the same website (domain). It's not working across domains (like when you call Bing Map API from your website). Having said that, I still wonder if we should use [Authorize] or always expect "Authorization" in HTTP request header. – Tohid Dec 28 '12 at 15:33
58

Marked you down because you didn't offer an answer to his problem, and more so, the Web Api is an asynchronous framework that works great with an ajax heavy web app. No one said you had to respect all tenents of RESTful design to gain benefits from using the Web API framework. – Brian Ogden Apr 13 '13 at 16:48
1

I agree with Brian although I didn't down-vote. RESTful interfaces - and Web API in particular - provide a simple, clean approach to implementing a service-based web app. But ultimately, I am far more interested in being productive than in being sufficiently "pure" about REST. – Mark Brittingham Jan 05 '14 at 19:08
4

@MarkS. is right to inform that Web API is not supposed to be aware of session state. Negative answer still remain an answer. Up vote. – Antoine Meltzheim Mar 06 '14 at 22:22
Session is still useful for caching of custom IPrincipal implementations to be placed on the current thread/context/application, as per Rockford Lhotka's "C# 2008 Business Objects". But I would agree, the APIs logic itself shouldn't require session state. – Richard Collette Aug 19 '14 at 22:18
I can't think of a single session based application I've ever made that has ever NOT needed session information in the web api. Sure if I make a REST service totally, entirely, and comprehensively intended only for non user specific executions, then sure. I didn't down vote, but I wanted to. Nothing personal, I just wholeheartedly disagree. Try and say that same statement (OP) to anyone coding in any other web language. This is another strong hand of microsoft problem. – Barry Mar 21 '17 at 22:01

score 20 · Answer 5 · edited Jun 27 '12 at 15:55

20

Mark, if you check the nerddinner MVC example the logic is pretty much the same.

You only need to retrieve the cookie and set it in the current session.

Global.asax.cs

public override void Init()
{
    this.AuthenticateRequest += new EventHandler(WebApiApplication_AuthenticateRequest);
    base.Init();
}

void WebApiApplication_AuthenticateRequest(object sender, EventArgs e)
{
    HttpCookie cookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
    FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);

    SampleIdentity id = new SampleIdentity(ticket);
    GenericPrincipal prin = new GenericPrincipal(id, null); 

    HttpContext.Current.User = prin;
}

enter code here

You'll have to define your "SampleIdentity" class, which you can borrow from the nerddinner project.

edited Jun 27 '12 at 15:55

Schiavini

2,869
2
23
49

answered Mar 07 '12 at 12:07

JSancho

1,435
1
13
15

The identity class is in NerdDinner_2.0\NerdDinner\Models\NerdIdentity.cs. – mhenry1384 Apr 10 '14 at 13:12
This doesn't work for me (in .NET 4). I never have that cookie. Does it only work if you have FormsAuthentication turned on? – mhenry1384 Apr 10 '14 at 18:54
the cookie does indeed get generated after you authenticate through the login form. You could also customise how/when it gets created, see http://stackoverflow.com/questions/7217105/ But you still need the user to effectively authenticate against the web server – JSancho Apr 10 '14 at 23:00
The question asks for HttpContext.Current.Session and this answer does not clearly explains what needs to be done. See @LachlanB answer. – JCallico Apr 29 '14 at 20:50

score 16 · Answer 6 · edited Jul 26 '15 at 09:34

16

To fix the issue:

protected void Application_PostAuthorizeRequest()
{
    System.Web.HttpContext.Current.SetSessionStateBehavior(System.Web.SessionState.SessionStateBehavior.Required);
}

in Global.asax.cs

edited Jul 26 '15 at 09:34

nhahtdh

55,989
15
126
162

answered Jul 25 '15 at 18:13

Suresh Muttagi

171
1
7

4

Warning! This will enable session for ALL requests. This can really hurt performance if your application is using embedded resources. – cgatian Sep 28 '15 at 13:56
@cgatian any alternative solution **fixed** ? – Kiquenet May 13 '16 at 09:55
I think the best approach is what @Treyphor suggests. Don't enable it for all requests. Just routes that have "/api" or something in the URL. Also, if possible set session state to read only for your API controllers. – cgatian May 13 '16 at 11:09

score 11 · Answer 7 · answered Feb 03 '13 at 01:52

Last one is not working now, take this one, it worked for me.

in WebApiConfig.cs at App_Start

    public static string _WebApiExecutionPath = "api";

    public static void Register(HttpConfiguration config)
    {
        var basicRouteTemplate = string.Format("{0}/{1}", _WebApiExecutionPath, "{controller}");

        // Controller Only
        // To handle routes like `/api/VTRouting`
        config.Routes.MapHttpRoute(
            name: "ControllerOnly",
            routeTemplate: basicRouteTemplate//"{0}/{controller}"
        );

        // Controller with ID
        // To handle routes like `/api/VTRouting/1`
        config.Routes.MapHttpRoute(
            name: "ControllerAndId",
            routeTemplate: string.Format ("{0}/{1}", basicRouteTemplate, "{id}"),
            defaults: null,
            constraints: new { id = @"^\d+$" } // Only integers 
        );

Global.asax

protected void Application_PostAuthorizeRequest()
{
  if (IsWebApiRequest())
  {
    HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
  }
}

private static bool IsWebApiRequest()
{
  return HttpContext.Current.Request.AppRelativeCurrentExecutionFilePath.StartsWith(_WebApiExecutionPath);
}

fournd here: http://forums.asp.net/t/1773026.aspx/1

This is the simplest solution but has a few mistakes in the code so that it doesn't actually work. I have posted another solution based on this one, feel free to edit yours to match mine. — Rocklan, Jul 09 '13 at 02:28
Slight correction on the _WebApiExecutionPath line needs to read public static string _WebApiExecutionPath = "~/api"; — stephen ebichondo, May 16 '16 at 11:27

score 8 · Answer 8 · answered Sep 17 '13 at 16:19

Following on from LachlanB's answer, if your ApiController doesn't sit within a particular directory (like /api) you can instead test the request using RouteTable.Routes.GetRouteData, for example:

protected void Application_PostAuthorizeRequest()
    {
        // WebApi SessionState
        var routeData = RouteTable.Routes.GetRouteData(new HttpContextWrapper(HttpContext.Current));
        if (routeData != null && routeData.RouteHandler is HttpControllerRouteHandler)
            HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
    }

Treyphor · Answer 9 · 2013-12-04T21:26:53.253

I had this same problem in asp.net mvc, I fixed it by putting this method in my base api controller that all my api controllers inherit from:

    /// <summary>
    /// Get the session from HttpContext.Current, if that is null try to get it from the Request properties.
    /// </summary>
    /// <returns></returns>
    protected HttpContextWrapper GetHttpContextWrapper()
    {
      HttpContextWrapper httpContextWrapper = null;
      if (HttpContext.Current != null)
      {
        httpContextWrapper = new HttpContextWrapper(HttpContext.Current);
      }
      else if (Request.Properties.ContainsKey("MS_HttpContext"))
      {
        httpContextWrapper = (HttpContextWrapper)Request.Properties["MS_HttpContext"];
      }
      return httpContextWrapper;
    }

Then in your api call that you want to access the session you just do:

HttpContextWrapper httpContextWrapper = GetHttpContextWrapper();
var someVariableFromSession = httpContextWrapper.Session["SomeSessionValue"];

I also have this in my Global.asax.cs file like other people have posted, not sure if you still need it using the method above, but here it is just in case:

/// <summary>
/// The following method makes Session available.
/// </summary>
protected void Application_PostAuthorizeRequest()
{
  if (HttpContext.Current.Request.AppRelativeCurrentExecutionFilePath.StartsWith("~/api"))
  {
    HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
  }
}

You could also just make a custom filter attribute that you can stick on your api calls that you need session, then you can use session in your api call like you normally would via HttpContext.Current.Session["SomeValue"]:

  /// <summary>
  /// Filter that gets session context from request if HttpContext.Current is null.
  /// </summary>
  public class RequireSessionAttribute : ActionFilterAttribute
  {
    /// <summary>
    /// Runs before action
    /// </summary>
    /// <param name="actionContext"></param>
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
      if (HttpContext.Current == null)
      {
        if (actionContext.Request.Properties.ContainsKey("MS_HttpContext"))
        {
          HttpContext.Current = ((HttpContextWrapper)actionContext.Request.Properties["MS_HttpContext"]).ApplicationInstance.Context;
        }
      }
    }
  }

Hope this helps.

Sorry , for the method you created GetHttpContextWrapper() in base APIController. But Base ApiContorller class is abstract class. How did you achieve implementing it? — meekash55, Nov 17 '22 at 03:04

score 6 · Answer 10 · answered Apr 29 '14 at 20:48

I followed @LachlanB approach and indeed the session was available when the session cookie was present on the request. The missing part is how the Session cookie is sent to the client the first time?

I created a HttpModule which not only enabling the HttpSessionState availability but also sends the cookie to the client when a new session is created.

public class WebApiSessionModule : IHttpModule
{
    private static readonly string SessionStateCookieName = "ASP.NET_SessionId";

    public void Init(HttpApplication context)
    {
        context.PostAuthorizeRequest += this.OnPostAuthorizeRequest;
        context.PostRequestHandlerExecute += this.PostRequestHandlerExecute;
    }

    public void Dispose()
    {
    }

    protected virtual void OnPostAuthorizeRequest(object sender, EventArgs e)
    {
        HttpContext context = HttpContext.Current;

        if (this.IsWebApiRequest(context))
        {
            context.SetSessionStateBehavior(SessionStateBehavior.Required);
        }
    }

    protected virtual void PostRequestHandlerExecute(object sender, EventArgs e)
    {
        HttpContext context = HttpContext.Current;

        if (this.IsWebApiRequest(context))
        {
            this.AddSessionCookieToResponseIfNeeded(context);
        }
    }

    protected virtual void AddSessionCookieToResponseIfNeeded(HttpContext context)
    {
        HttpSessionState session = context.Session;

        if (session == null)
        {
            // session not available
            return;
        }

        if (!session.IsNewSession)
        {
            // it's safe to assume that the cookie was
            // received as part of the request so there is
            // no need to set it
            return;
        }

        string cookieName = GetSessionCookieName();
        HttpCookie cookie = context.Response.Cookies[cookieName];
        if (cookie == null || cookie.Value != session.SessionID)
        {
            context.Response.Cookies.Remove(cookieName);
            context.Response.Cookies.Add(new HttpCookie(cookieName, session.SessionID));
        }
    }

    protected virtual string GetSessionCookieName()
    {
        var sessionStateSection = (SessionStateSection)ConfigurationManager.GetSection("system.web/sessionState");

        return sessionStateSection != null && !string.IsNullOrWhiteSpace(sessionStateSection.CookieName) ? sessionStateSection.CookieName : SessionStateCookieName;
    }

    protected virtual bool IsWebApiRequest(HttpContext context)
    {
        string requestPath = context.Request.AppRelativeCurrentExecutionFilePath;

        if (requestPath == null)
        {
            return false;
        }

        return requestPath.StartsWith(WebApiConfig.UrlPrefixRelative, StringComparison.InvariantCultureIgnoreCase);
    }
}

This works great. This keeps the session the same between requests as long as it hasn't timed out. Not sure if I am going to use it in prod just yet until I figure out a good way to switch the session state between required and read only to stop request blocking, but this has given me the starting path that I desire. Thank you! — Derreck Dean, Aug 19 '16 at 16:15

score 3 · Answer 11 · answered Aug 31 '15 at 14:30

one thing need to mention on @LachlanB 's answer.

protected void Application_PostAuthorizeRequest()
    {
        if (IsWebApiRequest())
        {
            HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
        }
    }

If you omit the line if (IsWebApiRequest())

The whole site will have page loading slowness issue if your site is mixed with web form pages.

score 0 · Answer 12 · answered Nov 08 '19 at 04:56

Yes, session doesn't go hand in hand with Rest API and also we should avoid this practices. But as per requirements we need to maintain session somehow such that in every request client server can exchange or maintain state or data. So, the best way to achieve this without breaking the REST protocols is communicate through token like JWT.

https://jwt.io/

Andy A. · Answer 13 · 2013-10-23T15:35:12.197

-4

Going back to basics why not keep it simple and store the Session value in a hidden html value to pass to your API?

Controller

public ActionResult Index()
        {

            Session["Blah"] = 609;

            YourObject yourObject = new YourObject();
            yourObject.SessionValue = int.Parse(Session["Blah"].ToString());

            return View(yourObject);
        }

cshtml

@model YourObject

@{
    var sessionValue = Model.SessionValue;
}

<input type="hidden" value="@sessionValue" id="hBlah" />

Javascript

$(document).ready(function () {

    var sessionValue = $('#hBlah').val();

    alert(sessionValue);

    /* Now call your API with the session variable */}

}

edited Oct 23 '13 at 15:35

answered Oct 23 '13 at 14:55

Andy A.

31
3

1

Waht if the application uses both MVC and WebAPI? Also, it is more reasonable some things to be stored at server side, e. g. Sharepoint security tokens. Instead of implementing a special wrapper for tokens storage like azure blobs container, sometimes is reasonable reuse Session for this type of data. The Sharepoint security context as it implemented in app template, uses the session to store these security contexts, and only small pieces of data being transfered (session tag) instead of few kilobytes of data. It would be awesome if these context would be smaller... – Konstantin Isaev Mar 31 '14 at 14:34

Accessing Session Using ASP.NET Web API

13 Answers13

MVC

WebApiConfig.cs

Global.asax.cs

_Layout.cshtml

WebForms

Dot Net Core

Startup.cs

SessionController.cs

Performance Concerns

Security Concerns

Why to avoid using Session in WebAPI?

Concurrent Requests and Session State

Linked

Related