`DistributedSession` tries to refresh non-existent keys
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
`DistributedSession.CommitAsync` branches on `_isModified` and either calls `_cache.SetAsync` to write the modified session content to the cache, or it calls `_cache.RefreshAsync` to refresh the cache entry and extend its sliding expiration window.
When handling a request without a session cookie, the `SessionMiddleware` will generate a new session key and later on end up calling `DistributedSession.CommitAsync`. If the session hasn't been modified by the endpoint, the call to `_cache.RefreshAsync` will happen with the newly generated session key. Since the session is newly created and wasn't modified, it cannot exist in the cache at this point and the attempt to refresh the cache entry seems to be pointless.
If the application only requires access to the session in some specific areas, this will cause every single request to hit the cache backend with a refresh for a non-existent key.
While the performance and latency penalty (depending on the cache backend) are likely negligible, I would have expected `DistributedSession.CommitAsync` to account for it by checking `_isNewSessionKey`.
```
if (_isModified)
{
// update cache entry
}
else if (!_isNewSessionKey) // <-- else if instead of else
{
// refresh cache entry
}
```
Is there a reason this isn't done?
Contributor guide
Assessment
This issue has not been assessed yet.