Question

I’m quite new to vb.net as I’m much more of a PHP developer but anyway. I’ve built a web application but my users seem to be sharing the same session which I do not want and can’t understand why. I access the object which I store all session information in from a global property in a module, could this be the reason?

The code is as follows:

Module SiteWide
    Private mUserSession As New MyLib.User.UserSession
    Public Property gUserSession() As MyLib.User.UserSession
        Get
            If Not HttpContext.Current Is Nothing AndAlso Not HttpContext.Current.Session Is Nothing Then
                If Not HttpContext.Current.Session("user") Is Nothing Then
                    mUserSession = HttpContext.Current.Session("user")
                End If
            End If

            Return mUserSession 
        End Get
        Set(ByVal value As MyLib.User.UserSession)
            mUserSession = value

            If Not HttpContext.Current Is Nothing AndAlso Not HttpContext.Current.Session Is Nothing Then
                HttpContext.Current.Session("user") = value
            End If
        End Set
    End Property
End Module

Answer 1

Why are you using a static class(Module) as repository for your Session objects? Static means application wide. mUserSession is also static implicitely, therefore all users share the same Session. Actually the lines

mUserSession = value 

and

mUserSession = HttpContext.Current.Session("user")

in the getter/setter are overwriting it for all users.

You could wrap the Session object in your own class just for simplification:

For example:

Public Class MySession
    ' private constructor
    Private Sub New()
    End Sub

    ' Gets the current session.
    Public Shared ReadOnly Property Current() As MySession
        Get
            Dim session As MySession = DirectCast(HttpContext.Current.Session("__MySession__"), MySession)
            If session Is Nothing Then
                session = New MySession()
                HttpContext.Current.Session("__MySession__") = session
            End If
            Return session
        End Get
    End Property

    ' **** add your session properties here, e.g like this:
    Public Property MyID() As Guid
        Get
            Return m_ID
        End Get
        Set(value As Guid)
            m_ID = value
        End Set
    End Property
    Private m_ID As Guid

    Public Property MyDate() As DateTime
        Get
            Return m_MyDate
        End Get
        Set(value As DateTime)
            m_MyDate = Value
        End Set
    End Property
    Private m_MyDate As DateTime

End Class

Note: The Current-property is also shared/static, but the difference is that i’m returning HttpContext.Current.Session whereas you are returning a single/shared instance.