Session variables in action filter

Question

I have an action filter checks whether or not a session variable ID is set. For development purposes, I have manually set this variable prior to the check.

public class MyActionFilterAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuted(ActionExecutedContext context)
        {

            context.HttpContext.Session.Add("ID", 123123);

            int ID = (int)context.HttpContext.Session.Contents["ID"];
            var rd = context.HttpContext.Request.RequestContext.RouteData;

            TED _db = new TED();

            //if not in DB
            if (_db.Users.Find(ID) == null && rd.GetRequiredString("action") != "NoAccess")
            {
                RouteValueDictionary redirectTargetDictionary = new RouteValueDictionary();
                redirectTargetDictionary.Add("action", "NoAccess");
                redirectTargetDictionary.Add("controller", "Home");
                redirectTargetDictionary.Add("area", "");

                context.Result = new RedirectToRouteResult(redirectTargetDictionary);
            }

            base.OnActionExecuted(context);
        }
    }

As far as I understand, this code is run prior to any page, this Session["ID"] is always set. The site works fine if I am consistently testing, but it seems to break if I leave it for a while then try to continue testing. Here is the error I get:

int UserID = (int)Session.Contents["ID"];
System.NullReferenceException: Object reference not set to an instance of an object.

Initially I thought the session may simply be expiring, but prior to any page loading, Session["ID"] should be getting set. What is the issue here?

Answer 1

you're implementing your actionfilter's on OnActionExecuted method which executes AFTER your action method

You should implement the OnActionExecuting method

public class MyActionFilterAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(ActionExecutingContext context)
        {

            context.HttpContext.Session.Add("ID", 123123);

            int ID = (int)context.HttpContext.Session.Contents["ID"];
            var rd = context.HttpContext.Request.RequestContext.RouteData;

            TED _db = new TED();

            //if not in DB
            if (_db.Users.Find(ID) == null && rd.GetRequiredString("action") != "NoAccess")
            {
                RouteValueDictionary redirectTargetDictionary = new RouteValueDictionary();
                redirectTargetDictionary.Add("action", "NoAccess");
                redirectTargetDictionary.Add("controller", "Home");
                redirectTargetDictionary.Add("area", "");

                context.Result = new RedirectToRouteResult(redirectTargetDictionary);
            }

            base.OnActionExecuting(context);
        }
    }