dotnet / dotnet/aspnetcore

`DistributedSession` tries to refresh non-existent keys

Open
#56,233 0 comments 0 reactions 0 assignees View on GitHub
area-middleware
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

`DistributedSession.CommitAsync` branches on `_isModified` and either calls `_cache.SetAsync` to write the modified session content to the cache, or it calls `_cache.RefreshAsync` to refresh the cache entry and extend its sliding expiration window.

When handling a request without a session cookie, the `SessionMiddleware` will generate a new session key and later on end up calling `DistributedSession.CommitAsync`. If the session hasn't been modified by the endpoint, the call to `_cache.RefreshAsync` will happen with the newly generated session key. Since the session is newly created and wasn't modified, it cannot exist in the cache at this point and the attempt to refresh the cache entry seems to be pointless.

If the application only requires access to the session in some specific areas, this will cause every single request to hit the cache backend with a refresh for a non-existent key.

While the performance and latency penalty (depending on the cache backend) are likely negligible, I would have expected `DistributedSession.CommitAsync` to account for it by checking `_isNewSessionKey`.

```
if (_isModified)
{
// update cache entry
}
else if (!_isNewSessionKey) // <-- else if instead of else
{
// refresh cache entry
}
```

Is there a reason this isn't done?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.