Question

Given this Global.asax.cs:

using System;
using System.Web;

namespace Foo.Web {
    public class Global : HttpApplication {
        private const string IntroductionPageShownSessionKey = "IntroductionPageShownSessionKey";

        protected void Application_AcquireRequestState(object sender, EventArgs e) {
            ShowIntroductionIfNotYetShown();
        }

        private void ShowIntroductionIfNotYetShown() {
            if (HttpContext.Current.Session != null) {
                var introductionPageShown = Convert.ToBoolean(Session[IntroductionPageShownSessionKey]);
                if (!introductionPageShown) {
                    if (Request.Path.EndsWith("/Introduction.aspx")) {
                        Session[IntroductionPageShownSessionKey] = true;
                    }
                    else {
                        Response.Redirect("~/Introduction.aspx" + Request.Url.Query);
                    }
                }
            }
        }
    }
}

1. User hits webapp and is shown Introduction.aspx
2. User continues using webapp for a few minutes (ASP.NET_SessionId: ublbhu45ji31e055ywqu0555)
3. User falls idle (doesn’t perform any postbacks) for a few minutes
4. User performs postback
5. User is shown Introduction.aspx
6. Second inspection of user’s ASP.NET_SessionId cookie still shows ublbhu45ji31e055ywqu0555

Why is the user shown Introduction.apsx the second time inside the same ASP.NET Session? I’m familiar w/ the risk in setting session variables just before a redirect in the same postback, but that doesn’t apply here, right?

Answer 1

Keep in mind that the Session itself likely has a shorter lifetime than the session cookie being sent to the browser and the ID value set in that cookie. In fact, the browser can continue to submit an old session ID, and the server will accept it and create a new session from it, if the old was expired.

The implications being two possibilities:
1) The session is timing out due to the timeout config value (I know not the case in your particular instance)

2) What we’ve figured out since in your case via the comments to this question: the AppDomain was shutting down or being recycled.