The IT department of a subsidiary of ours had a consulting company write them an ASP.NET application. Now it’s having intermittent problems with mixing up who the current user is and has been known to show Joe some of Bob’s data by mistake.
The consultants were brought back to troubleshoot and we were invited to listen in on their explanation. Two things stuck out.
First, the consultant lead provided this pseudo-code:
void MyFunction() { Session['UserID'] = SomeProprietarySessionManagementLookup(); Response.Redirect('SomeOtherPage.aspx'); } He went on to say that the assignment of the session variable is asynchronous, which seemed untrue. Granted the call into the lookup function could do something asynchronously, but this seems unwise.
Given that alleged asynchronousness, his theory was that the session variable was not being assigned before the redirect’s inevitable ThreadAbort exception was raised. This faulure then prevented SomeOtherPage from displaying the correct user’s data.
Second, he gave an example of a coding best practice he recommends. Rather than writing:
int MyFunction(int x, int x) { try { return x / y; } catch(Exception ex) { // log it throw; } } the technique he recommended was:
int MyFunction(int x, int y, out bool isSuccessful) { isSuccessful = false; if (y == 0) return 0; isSuccessful = true; return x / y; } This will certainly work and could be better from a performance perspective in some situations.
However, from these and other discussion points it just seemed to us that this team was not well-versed technically.
Opinions?
I would agree. These guys seem quite incompetent.
(BTW, I’d check to see if in ‘SomeProprietarySessionManagementLookup,’ they’re using static data. Saw this — with behavior exactly as you describe on a project I inherited several months ago. It was a total head-slap moment when we finally saw it … And wished we could get face to face with the guys who wrote it … )