title: How to best fix an InProc session state variable \ multi instance problem?
body: <p>I've recently been tasked with fixing a rather nasty bug resulting from the misuse of session state. We have an asp.net web application that runs on a single sever using inproc session state.  The basic design is that a typed dataset is loaded from the database and stored in session state using a common session variable name like Session["dataset"] = dataset. After the data is stored in the session the user edits the data, dataset is retrieved from the session updated and sent to the database for updating.  This type of data editing\storing is used across multiple webforms that basically do the same thing.  All is good until a user tries to launch a second instance of the application and data stored within the session variable can get mixed up.</p>
  
  <p>Here are the possible fixes that I've been able to find </p>
  
  <ol>
  <li><p>Set sessionState cookieless="false" (every new instance gets a unique session id)
  PROS - easiest solution, almost no code changes needed
  CONS - guid in url, user can edit guid, guid can be copied</p></li>
  <li><p>Use a custom session key for every instance (pass a session key around and combine it the "dataset" + session key name so that each instance has a unique session variable)
  PROS - no guid in url
  CONS - most amount of code changes, possibly fragile</p></li>
  <li><p>Remove the session variable (Load the dataset from the database a second time for editing)
  PROS- frees up server resources, no longer dependent upon session state
  CONS - performance hit, high amount of code changes </p></li>
  </ol>
  
  <p>Anyone know of any other possible solutions?  Thanks</p>