I am working on maintaining an ASP.NET website, and I’ve noticed the business layer and other supporting libraries make heavy use of HttpContext.Current.Session. This makes it hard to keep track of session variables, to determine what they’re used for and why they even exist.
Is it considered bad practice to use the session in the business layer? And would it be wise to start moving all code that uses the session into the code-behind?
It’s almost never a good idea. There’s lots of reasons, but here’s a couple:
We ran into huge headaches with this exact same situation when we started to build services that utilized common business layer code.