title: Concurrent requests: session lost after removing session-id from one single request
body: <p>In my ASP .NET MVC 2 - application, there are several controllers, that need the session state. However, one of my controllers in some cases runs very long and the client should be able to stop it. </p>
  
  <p>Here is the long running controller:</p>
  
  <pre><code>    [SessionExpireFilter]
      [NoAsyncTimeout]
      public void ComputeAsync(...) //needs the session
      {
      }
  
      public ActionResult ComputeCompleted(...)
      {
  
      }
  </code></pre>
  
  <p>This is the controller to stop the request:</p>
  
  <pre><code>    public ActionResult Stop()
      {
        ...
      }
  </code></pre>
  
  <p>Unfortunately, in ASP .NET MVC 2 concurrent requests are not possible for one and the same user, so my Stop-Request has to wait until the long running operation has completed. Therefore I have tried the trick described in <a href="http://weblogs.asp.net/imranbaloch/archive/2010/07/10/concurrent-requests-in-asp-net-mvc.aspx" rel="nofollow">this article</a> and added the following handler to Global.asax.cs:</p>
  
  <pre><code>    protected void Application_BeginRequest()
      {
          if (Request.Url.AbsoluteUri.Contains("Stop") &amp;&amp; Request.Cookies["ASP.NET_SessionId"] != null)
          {
              var session_id = Request.Cookies["ASP.NET_SessionId"].Value;
  
              Request.Cookies.Remove("ASP.NET_SessionId");
              ...
          }
      }
  </code></pre>
  
  <p>This simply removes the session-id from the Stop-Request. At the first glance this works well - the Stop-Request comes through and the operation is stopped. <strong>However, after that, it seems that the session of the user with the long running request has been killed.</strong> </p>
  
  <p>I use my own <strong>SessionExpireFilter</strong> in order to recognize session timeouts:</p>
  
  <pre><code> public class SessionExpireFilterAttribute : ActionFilterAttribute
   {
      public override void OnActionExecuting(ActionExecutingContext filterContext)
      {
          HttpContext ctx = HttpContext.Current;
  
          // check if session is supported
          if (ctx.Session != null)
          {
              // check if a new session id was generated
              if (ctx.Session.IsNewSession)
              {
  
                  // If it says it is a new session, but an existing cookie exists, then it must
                  // have timed out
                  string sessionCookie = ctx.Request.Headers["Cookie"];
                  if ((null != sessionCookie) &amp;&amp; (sessionCookie.IndexOf("ASP.NET_SessionId") &gt;= 0))
                  {
  
                      filterContext.Result = new JsonResult() { Data = new { success = false, timeout = true }, JsonRequestBehavior = JsonRequestBehavior.AllowGet };
                  }
              }
          }
  
          base.OnActionExecuting(filterContext);
      }
  }
  </code></pre>
  
  <p>ctx.Session.IsNewSession is always true after the Stop-Request has been called, but I don't know why. Does anyone know why the session is lost? Is there any mistake in the implementation of the Stop-Controller?</p>