Access Session Variable from HTTPModule

Question

How can I access session variable from the HttpModule?

I set following session variable in .cs page, which I want access in the HttpModule:

Session["username"] = "BLAH"

Clayclaybank

Answer 1

Here is an example of using session within HttpModule, found here:

using System;
using System.Web;
using System.Web.Security;
using System.Web.SessionState;
using System.Diagnostics;

// This code demonstrates how to make session state available in HttpModule,
// regradless of requested resource.
// author: Tomasz Jastrzebski

public class MyHttpModule : IHttpModule
{
   public void Init(HttpApplication application)
   {
      application.PostAcquireRequestState += new EventHandler(Application_PostAcquireRequestState);
      application.PostMapRequestHandler += new EventHandler(Application_PostMapRequestHandler);
   }

   void Application_PostMapRequestHandler(object source, EventArgs e)
   {
      HttpApplication app = (HttpApplication)source;

      if (app.Context.Handler is IReadOnlySessionState || app.Context.Handler is IRequiresSessionState) {
         // no need to replace the current handler
         return;
      }

      // swap the current handler
      app.Context.Handler = new MyHttpHandler(app.Context.Handler);
   }

   void Application_PostAcquireRequestState(object source, EventArgs e)
   {
      HttpApplication app = (HttpApplication)source;

      MyHttpHandler resourceHttpHandler = HttpContext.Current.Handler as MyHttpHandler;

      if (resourceHttpHandler != null) {
         // set the original handler back
         HttpContext.Current.Handler = resourceHttpHandler.OriginalHandler;
      }

      // -> at this point session state should be available

      Debug.Assert(app.Session != null, "it did not work :(");
   }

   public void Dispose()
   {

   }

   // a temp handler used to force the SessionStateModule to load session state
   public class MyHttpHandler : IHttpHandler, IRequiresSessionState
   {
      internal readonly IHttpHandler OriginalHandler;

      public MyHttpHandler(IHttpHandler originalHandler)
      {
         OriginalHandler = originalHandler;
      }

      public void ProcessRequest(HttpContext context)
      {
         // do not worry, ProcessRequest() will not be called, but let's be safe
         throw new InvalidOperationException("MyHttpHandler cannot process requests.");
      }

      public bool IsReusable
      {
         // IsReusable must be set to false since class has a member!
         get { return false; }
      }
   }
}

Conform

OriginalHandler.ProcessRequest(context); in ProcessRequest if your code actually does call ProcessRequest(<C>) – Riobard

Anyone know if this is still valid? I'm getting errors in the debug.assert saying that session isn't available in this context. – Avalokitesvara

Answer 2

I suggest a less invasive approach. Just force ASP.NET runtime to expose session to your module with SetSessionStateBehavior() (implementations of IRequiresSessionState are considered only for IHttpHandlers).

public void Init(HttpApplication httpApp)
{
   //SESSION WILL BE AVAILABLE IN ALL EVENTS FROM PreRequestHandlerExecute TO PostRequestHandlerExecute
   httpApp.PostRequestHandlerExecute += OnPostRequestHandlerExecute;
   //THIS IS THE IMPORTANT LINE
   httpApp.Context.SetSessionStateBehavior(SessionStateBehavior.ReadOnly);
}

Wiggs