title: ASP.NET: Multiple Session objects in a single application
body: <p>I have one ASP.NET web application running at the web server root which provides multiple (similar) web sites by using URL redirection. To give a real world example:</p>
  
  <pre><code>http://webshopserver/company1/ProductList.aspx -&gt; http://webshopserver/ProductList.aspx?showProductsFrom=company1
  http://webshopserver/company2/ProductList.aspx -&gt; http://webshopserver/ProductList.aspx?showProductsFrom=company2
  ...
  </code></pre>
  
  <p>This works very fine; the only problem is that, obviously, all of these different shops share the same session object (since the InProc session manager stores the session object in the AppDomain). I would like the shops of company1 and company2 to have different session objects, so that, for example, if a user opens the shops of company1 and company2 in different tabs of the same browser window, the items put in the shopping cart of company1 won't show up in the cart of company2.</p>
  
  <p>There are a few obvious approaches to solve this problem that I don't like:</p>
  
  <ul>
  <li><em>Create my own Session object which encapsulates everything into a HashMap&lt;CompanyName, whatever&gt; and then stores it in the "real" session</em>: That breaks all existing code that uses the session object.</li>
  <li><em>Use URLs like <a href="http://company1.webshopserver/" rel="nofollow noreferrer">http://company1.webshopserver/</a> and a wildcard DNS record, because the session ID cookie is tied to the domain</em>: That's ugly (because the real-world equivalent of "webshopserver" is already long enough).</li>
  <li><em>Write my own custom Session Provider</em>: That would be kind of like reinventing the wheel.</li>
  <li><em>Create a separate IIS application for every company</em>: Won't work, because creating new companies should be possible through something like <a href="http://webshopserver/CreateYourOwnWebshop.aspx" rel="nofollow noreferrer">http://webshopserver/CreateYourOwnWebshop.aspx</a> without any human (server admin) intervention afterwards.</li>
  </ul>
  
  <p>I'm thinking more of a solution along the lines of:</p>
  
  <ul>
  <li>restricting the path of the session cookie to <a href="http://webshopserver/&lt;companyName&gt;/" rel="nofollow noreferrer">http://webshopserver/&lt;companyName&gt;/</a> or</li>
  <li>telling ASP.NET to use different AppDomains depending on the URL.</li>
  </ul>
  
  <p>So, any information on how to achieve one of these points (or maybe a different solution altogether) would be helpful.</p>