Finding all use of session state

Question

I'm looking for some smart ideas on how to quickly find all usage of session state within an existing asp.net (MVC) application.

The application in question was the subject of outsourced development, and has been running fine in production. But we recently realised that it's using InProc session state rather than (our preferred route) StateServer.

In a small scale test, we switched it over to StateServer, and all worked fine. However, when we deployed to production, we suddenly experienced a large number of errors. I'm not sure if these errors were caused by this change (they were actually complaining about database level problems), but removing the change allowed the application to function once again (this may have just been because it caused a recycle to occur).

So before I try switching it again, I'd like to perform a thorough audit of all objects being placed in the session (I'd previously taken a quick look at a couple of controllers, and they seemed fine). If I had full control over the code, this is the kind of place where I'd just comment out the class (to compile and find the various ways of reaching the session class), then comment out the accessors, hit compile, and visit each error. But I can't do that with built in .NET framework types.

So, any smart ideas on how to find each usage?

---

I decided to try using Reflector. I've analyzed the "Used By" for each of the following:

System.Web.HttpSessionStateBase.set_Item(String, Object) : Void
System.Web.SessionState.HttpSessionState.set_Item(String, Object) : Void
System.Web.SessionState.HttpSessionState.set_Item(Int32, Object) : Void
System.Web.HttpSessionStateBase.set_Item(Int32, Object) : Void
System.Web.HttpSessionStateBase.Add(String, Object) : Void
System.Web.SessionState.HttpSessionState.Add(String, Object) : Void

(and checked that we don't use TempData anywhere). Am I missing any other routes by which items can end up in the Session?

Answer 1

You can get the source for asp.net MVC. to look for use of Session

http://aspnet.codeplex.com/releases/view/58781 for MVC 3 http://aspnet.codeplex.com/releases/view/41742 for MVC 2 http://aspnet.codeplex.com/releases/view/24471 for MVC 1

I've actually found these quite useful to have laying around for when you need to find out why something is doing what it does.

MVC 2 won't run with Session switched off, so it may be using the session in ways not compatible with stateserver.

From the DB errors, sounds like nHibernate maybe doing something. You could get the source for that as well to have a look see, but I'm sure it's use of session will be documented.

Simon