CODEWITHSUNDEEP
asp.netasp.net-mvcasp.net-web-api
Mrinal Kamboj
Mrinal Kamboj

Reputation: 11478

Session state access in Web API across domains

I have a ASP.Net API implementation, where to store and access the data / variables across consecutive calls, I am using a session state object as shown below and it can be successfully accessed in the multiple calls to separate calls by a browser:

// Access the current session object
var blSession = HttpContext.Current.Session;

// create the BL object using the user id
BL accessBL = new BL(userID);

// Store the Bl object in the session object dictionary
blSession["UserBL"] = accessBL;

I have to enable the following setting in the Global.asax, for the Session object to be accessible:

protected void Application_PostAuthorizeRequest()
{
  // Enable session state in the web api post authorization
  HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
}

Issue comes in when the WebAPI shown above has to be accessed via another ASP.Net MVC client, which is separately hosted on a different machine, at that time same consecutive calls do not maintain the state as shown above and thus it leads to an exception, since the consecutive calls rely on session data to proceed.

I have seen a similar issue when I seen the similar issue when I use the Fiddler Debugger, as it gets hosted as a web proxy, so consecutive calls through that too fails, since it does not maintain the state. In my understanding, issue is due to setting the Cookie across domain, which doesn't seem to work across domains due to security reason

I know a workaround is to use an application wide variable like Cache, but please suggest if you have a way to get the SessionState work. Let me know if you need more details.

Upvotes: 0

Views: 760

Answers (1)

Matthew at Critical Cognition
Matthew at Critical Cognition

Reputation: 851

If you have not setup an alternative way to do SessionState, then the default behavior is to do it InMemory on the server. This is why you are seeing issues when the request is handled by a different ASP.NET server.

Web API calls are meant to be stateless. That is, they should not perform like a classic ASP.NET application that relies on the framework to store user specific information in Session variables across HTTP requests. For each call, pass in a user-specific identifier or token that you can then use to lookup information stored in your backend. You can store this information in your database or a distributed cache like MemCache for faster retrieval.

Upvotes: 1

Related Questions