ASP.NET MVC Session Variables Lost

Question

My session variables are being lost between pages. Interestingly, this seems to be environment-specific - in our production environment, this works fine, in our test environment, we lose the session variables. This previously used to work in our test environment with the same code, which leads me to believe it's some IIS or server setting that's different.

This is an integration to SFDC where I am adding some session variables on page load. Then, after a user goes through a login flow, SFDC calls back and I try to read those session variables.

Here's how I set the session variables:

Session.Add("tenantID", tenantId);
Session.Add("clientID", tenantInfo.SalesforceKey);
Session.Add("session", session);
Session.Add("clientSecret", tenantInfo.SalesforceSecret);
Session.Add("userEmail", user.Email);
Logger.Debug("Set session tenantID to " + int)Session["tenantID"]).ToString()); // This outputs the proper value.

However, in our callback function in the same controller, when running this code, all session variables are null.

public ViewResult Callback(string code)
{

    Logger.Debug("Entering callback, code:" + code);
    Logger.Debug("Session vars:");

    if (Session["tenantID"] == null) // This is true
        Logger.Debug("tenantID: null"); 

    if (Session["clientID"] == null) // This is true
        Logger.Debug("clientID: null");

    if (Session["session"] == null) // This is true
        Logger.Debug("session: null");

    if (Session["clientSecret"] == null) // This is true
        Logger.Debug("clientSecret: null");

    // etc...

}

Initially I thought session was being ended, so I added the following in Global.asax. There's no session ended log line output until well after the callback executes.

    void Session_End(Object sender, EventArgs E)
    {
        // Clean up session resources
        Logger.Info("session ended for " + (string)Session["userEmail"]);
    }

    void Session_Start(Object sender, EventArgs E)
    {
        // Clean up session resources
        Logger.Info("session started.");
    }

Some clues that might help here: - I ran a fiddler to capture the initial page load and the callback, and the ASP.NET session ID was the same in both requests:

 (Page Load): Cookie: ASP.NET_SessionId=j1ggxuamkc2rk3q03z2vwye1

 (Callback):  Cookie: ASP.NET_SessionId=j1ggxuamkc2rk3q03z2vwye1

• Previously, our logger statements would output to one file, however, we use log4net, and it now seems to be creating a second file to output the callback logger statements. In production, we only see one file. If I get a session end log from the Global.asax code in the first file (associated with page load), I can read the session values. If I get a session end log in the second log file (associated with callback), the session values are null again.

• My web.config does not have any sessionState element included, and this is set the same across production and test.

Thank you for your help.

Here are the IIS Session State settings for that web application:

• Session State Mode settings: Set to In Process
• Cookie Settings: Mode: Use Cookies
• Name: ASP.NET_SessionId
• Time-out: 20 minutes
• Regenerate expired session ID is unchecked
• Use hosting identity for impersonation is checked

Answer 1

I have also similar situation where our application runs fine in server and not in local due to session variable null. If you are implementing sessionfilter in MVC, it is better to run the application in IIS Express in visual studio instead of visual studio development server. That solves our problem of session loss.

Answer 2

Compare the settings for the application pools between the test and prod environment.