Question

Is it possible to use it with everything like in threads, with locking?

Main idea is to track whether some web-method is already invoked by same user, so we want to block more than X calls in a minute. We would keep some data in relevant HashTable.

Answer 1

ASP.NET Sessions are dependent on cookies, which are easily circumvented by malicious users. Since malicious users seem to be your problem, ASP.NET sessions aren’t the solution.

You could write a wrapper class containing a static Dictionary<UserID, List<DateTime>> allowing operations on the dictionary only with 1-2 methods and properly locking it.

eg

class UserLogger
{
    private Dictionary<int, List<DateTime>> _visits;

    public bool AddPageVisit(int userID)
    {
       // lock dictionary
       // add or update entry for the user,
       // remove from all entries the datetimes older than a minute
       // remove entries without datetimes
       // check if number of datetimes for the user > max allowed
       // unlock dictionary
    }
}

class RestrictedController
{
   private static UserLogger _userLogger;
}

Disclaimer: I just wrote this pseudo-code in the answer, it may contain typo’s.