Another breaking change in ASP.NET 2.0: Session.SessionID

February 25, 2007 · 2 min read

I only recently became aware of another breaking change in ASP.NET 2.0: In order to optimize session state management, some changes have been implemented. One of the most puzzling ones when you're not aware of it can be reproduced as follows:

  • In ASP.NET 1.1, create a new web application.
  • Add a label to the page, name it lblSessionID.

<asp:Label Runat="server" ID="lblSessionID" />

  • In the code behind, add the following code in the "Page_Load" method:

protected void Page_Load(object sender, EventArgs e) { lblSessionID.Text = this.Session.SessionID; }

  • Load the page in the web browser. Press F5 as many times as you like, and the SessionID remains the same.

This behaviour is expected, and my guess is that quite a few applications rely on the SessionID being consistent on every page refresh.

However, in ASP.NET 2.0, the behaviour is different, which may cause applications to break: If you create a new website (or a new web application) and reproduce all the steps above, the SessionID will be different on every refresh of the page. The reason is found in MSDN:

"When using cookie-based session state, ASP.NET does not allocate storage for session data until the Session object is used. As a result, a new session ID is generated for each page request until the session object is accessed. If your application requires a static session ID for the entire session, you can either implement the Session_Start method in the application's Global.asax file and store data in the Session object to fix the session ID, or you can use code in another part of your application to explicitly store data in the Session object."

Since cookie-based session state is the default, this change of behaviour will affect existing web applications relying on the SessionID to identify the current user without having previously stored data in the Session object.

Here is a possible fix:

protected void Page_Load(object sender, EventArgs e) { if ( this.Session[ "dummy" ] == null ) { this.Session[ "dummy" ] = 1; } lblSessionID.Text = this.Session.SessionID; }

Not very elegant, and I can't say that I totally understand the reason why the ASP.NET team doesn't offer a better way to keep the SessionID consistent all the time, even when nothing is stored in the Session object. Anyway, this has caused me a few headaches, so hopefully this article will help other developers.

This article is part of the GWB Archives. Original Author: Laurent Bugnion

New on Geeks with Blogs

  • We Won The One Award I Actually Care About

    Full Scale made the Inc. 5000 for the fifth year straight, the 12th listing across my three companies. Here is why the one award you cannot buy is worth stopping for.

  • Your Customers Build the Features Now

    I let a tool I liked sit dead for a year rather than build the features I wanted. An MCP server meant I never had to, and your customers can do the same to your product.

  • Get the Size of a Directory in Linux the Easy Way

    du -sh for the quick answer, ncdu for the cleanup, df for the disk itself: every command for checking directory size in Linux, plus why du and df never agree.

  • Vim Search and Replace: The Ultimate Guide

    One :%s command replaces every match in a file before a find dialog would even open. The Vim substitute patterns worth the muscle memory: flags, ranges, capture groups, and multi-file edits.