Does a change to an ASP.NET site kill active sessions?

Question

I'm concerned about the possibility of my users' sessions getting swept away. I am using the default ASP.NET Session object and session cookies. I know that sessions can time out, and I have set the timeout value for my sessions to several hours to avoid surprise timeouts.

But there are at least two other cases I'm worried about.

1. I understand that ASP.NET periodically recycles the app domain running a site/web app (not sure if I have all the terminology correct here). Do sessions live across these recycle events?
2. At least on my development server, certain changes that I make to the site (e.g., adding a new page) seem to cause the active session to be lost when the site (or part of it) is recompiled. This does not seem to happen with every change, but with many it does. I'm particularly concerned about what this means for the possibility of changes while my site is live. I'd like to know the rules for what I can update without causing active sessions to be killed.

Thanks for any pointers.

Answer 1

This depends on your mode of session state. Here's a copy of something you can find on Microsoft Support:

ASP.NET supports three modes of session state:

• InProc: In-Proc mode stores values in the memory of the ASP.NET worker process. Thus, this mode offers the fastest access to these values. However, when the ASP.NET worker process recycles, the state data is lost.
• StateServer: Alternately, StateServer mode uses a stand-alone Microsoft Windows service to store session variables. Because this service is independent of Microsoft Internet Information Server (IIS), it can run on a separate server. You can use this mode for a load-balancing solution because multiple Web servers can share session variables. Although session variables are not lost if you restart IIS, performance is impacted when you cross process boundaries.
• SqlServer: If you are greatly concerned about the persistence of session information, you can use SqlServer mode to leverage Microsoft SQL Server to ensure the highest level of reliability. SqlServer mode is similar to out-of-process mode, except that the session data is maintained in a SQL Server. SqlServer mode also enables you to utilize a state store that is located out of the IIS process and that can be located on the local computer or a remote server.

If you use StateServer or a database your session data will not be lost when IIS detects a change to the website.

Answer 2

(1) If you use In process session mode on Recycling the application pool you'll lose the session information

(2) Depends if you are using web application or web site model for your asp.net application. Some files are cached on application start and require restart or recompilation if they are changed. The rule of thumb is that if you change Global.asax, config file of add, delete or edit file in \bin folder a restart of the application will be issued and In Process Session data will be lost.

ASP.NET Session has many flaws and many developers do not use it at all. I personally prefer to store data in custom tables in the SQL Server (if available).

If you want to provide more information like what version of IIS do you have, do you use web site or web application model, do you have database server available, do you use web farm or web garden server environment, and what information you want to store and for how long I can give you more concrete advice.