4

Question:

Normally, one accesses the session object like this:

Session["foo"] = "bar";

I have written a wrapper over it, which is generic, and which checks whether a session has expired or not, and throws a SessionExpiredException if that is so.

In order to use my session access, I have to access sessions over my class like this

WebApplications.SessionAccess.Set<string>("foo", "bar");

Now, obviously, despite the presence of the class SessionAccess, one could still access the session via the normal session object. This is not desirable, and additonally, I want to later include it in a larger old project which has been written using the normal Session, which would mean I would have to replace all calls to session (a number in the low thousands) with my wrapper.

Is there a way I can overwrite the System.Web.HttpSessionStateBase.Controller.Session - Property with my own ?

The thing is, without a custom session handler defined in web.config, because there sometimes already is one for using the database for sessions (one could still initialize a module in Global.asax).

Those NULL-Reference exception YSODs on SessionTimeout are hyper-disturbing.
If possible, a solution that works on classical ASP.NET web-forms as well as on MVC.

6
  • It's override, also, dont really understand the point of your problem.
    – leppie
    Feb 28, 2012 at 7:06
  • Hmm, on a sidenote, this is like an ideal application of detours/function interception for .NET. I could use the mole framework. Feb 28, 2012 at 7:07
  • 1
    Do you really need this? What about adding your helper methods as extension methods to the HttpSession class?
    – Dima Pasko
    Feb 28, 2012 at 7:10
  • You can override the Session property but you cannot substitute it with your own method as it doesn't have the same signature: your method is generic. Feb 28, 2012 at 7:14
  • @Darin Dimitro: True, but I can always write a wrapper around that one as well SessionAccess.Set<object>("foo", "bar"); Feb 28, 2012 at 7:28

1 Answer 1

0

I don't think that there will be any full-proof solution as you wants it but few tricks can make your life easier.

  1. Create yet another wrapper that provides indexer property so that you can easily substitute calls such as Session["key"] = "name" to your wrapper property;
  2. You need to inherit all your pages (i.e. code-behind classes) from a common base page class (that itself has inherited indirectly from System.Web.UI.Page). If you already have such base page then you are really in good situation. Inherit your common page base class from an internal base class that itself inherited from System.Web.UI.Page.
  3. In the common page base, add a new Session property that would return your wrapper object created in #1. Similar trick has to be done for UserControl (and custom control) if you have many of them. This will save you from replacing the most of Session["key"] = "name" kind of calls.
  4. Finally, override Session property in the internal base page class to add a debug assertion. You may choose to return null but that would break production usage. Debug assertion is a lot better to find session usage that will be escaped from #3.

As said, this is not a full-proof solution as one can still access the session state via HttpContext. But it should make the migration of legacy code to your session accessor object easier.

3
  • And then I have to replace all ascx and ascx instances, and if it's used in a class, it still crashes. I'm more looking for something along the lines of this: stackoverflow.com/questions/8487801/… Feb 28, 2012 at 7:49
  • @Quandary, unfortunately, HttpSessionState is a sealed class and hence, one cannot put any custom session state implementation in http context. Yes - it could be mocked but mocking can be costly!
    – VinayC
    Feb 28, 2012 at 9:23
  • Well, bad idea. The mole framework is a piece of crap. I give up. The answer to my question is: it's not possible. Feb 29, 2012 at 1:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.