Home/ Questions/Q 151549
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T09:28:02+00:00

I have an ASP.NET application that uses Session.SessionID to prevent multiple users viewing the

  • 0

I have an ASP.NET application that uses Session.SessionID to prevent multiple users viewing the same data at the same time.

I have a table that contains a set of images (stored in BLOB) that require processing. Only one user is supposed to be able to view the same image at the same time. To achieve this, as each record is retrieved by a user the record is updated with the Session.SessionID. This update occurs inside a ReaderWriterLock.

I have done a test to ensure the ReaderWriterLock is working correctly and can confirm that only one session can execute the code inside that block at once.

My current theory is that two different users are getting the same SessionID at the same time. A user of this application is allowed to view records they have locked or any unlocked images.

I have modified the application to display the SessionID in the footer of every page so that if the problem happens again I can check the SessionID value.

I’ve seen some articles online suggesting that SessionID is not unique and some saying that the SessionID is unique. I understand that SessionID is not unique forever but can the SessionID value be considered unique for active sessions?

This forum describes a similar problem

I have also read some suggestions that a Guid should be stored in the Session object and used as a unique ID instead of the Session ID.

Thanks for the responses so far. Here is a clarification based on the answers so far:

‘Locked forever’ – we prevent this by a lock timeout of 5 minutes. Before a user locks an image, while inside the ReaderWriterLock, we do a ‘cleanup’ of old locks (which unlocks images locked for more than 5 minutes), a query to get the oldest unlocked image and an update statement to ‘lock’ that image to the current session.

A possible cause of the problem would be if one user ‘locks’ an image but then leaves the PC for a short break. If they did nothing for 5 minutes, that image on there screen would be unlocked and potentially opened by another user. I mentioned this scenario when the problem was reported and I was assured that the users had been working continuously.

‘Different Window/Tab’ – I haven’t actually seen the error with my own eyes but the person who reported the problem has told me that it is two different PC’s and two different usernames of the logged in user.

Hopefully now that I am displaying the Session ID on the page, next time it happens I will be able to say with certainty whether it is the same Session ID on two machines or if it is some other problem. This issue has never occurred during the testing phase so it appears to be a symptom of a larger number of concurrent users.

Thanks for the responses so far and I will update this question as more information comes to hand.

It seems that the user didn’t give me the full story. Session ID is unique in our case as per the accepted answer. Two users were able to see the same image at the same time because user 1 was idle for the 5 minute ‘abandoned image’ unlock process. The ‘abandoned image’ timeout has been raised to match the session timeout to avoid this problem.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. This link says session ids are unique – http://support.microsoft.com/kb/899918

    Session ids are unique in that only 1 session will ever have that id at any given time.

    If this wasn’t the case I think there would be a lot of people shouting very loudly about it.

    • 0