Session_Start is run several times by default on the ASP.NET MVC3 project

Question

I think I found a problem with ASP.NET MVC and the event pipeline. In particular, I find that Session_Start is called several times, each of which contains a new SessionID.

Here step by step:

• Open VS2010
• File | New project
• ASP.NET MVC 3 web application, provide a default name, click OK
• Select an Internet application (although I don’t think it’s really important), click OK
• When creation is complete, edit the Global.asax.cs file

• Add the following method (yes it is empty):

  protected void Session_Start () {}

• Set a breakpoint in the method

• Debug
• Note that the breakpoint is caught twice before the page is displayed. If you see "Session.SessionID" when breakpoints are caught, you will see that the session identifier is new every time.
• As soon as you go to the home page, click on the link "Home" or "About".
• Session_Start will be started again, this time with a new SessionID.
• Continue execution, and any subsequent actions will no longer trigger Session_Start.

I tried the same thing on a standard ASP.NET web application (and not MVC), and Session_Start was run only once.

I am sure that I am not doing something wrong here, as I use the default project templates, and the only modifiable code is the Global.asax.cs file to add the Session_Start method.

I am using IIS Express, but I repeated the above steps using the Cassini web server (Visual Studio Development Server) with the same result.

Any tips?

UPDATE

I decided to use Fiddler to check HTTP traffic during a debugging session. It seems that:

• The first Session_Start is fired when I request a url. That seems reasonable. Then, the SessionID generated at this time is recorded in response to the browser. Again, it seems reasonable.
• Fiddler then shows the requests / responses for the * .js and * .css files. All success. None of them disable Session_Start. Still.
• Fiddler then shows that "/favicon.ico" was requested. At this time, Session_Start starts and generates a new SessionID ... I continue.
• In Fiddler, it shows that the file "/favicon.ico" was not found (404). A web page is displayed. I click on the "Home" link.
• The URL "/" is requested, and in Fiddler the response is OK. But then another "/favicon.ico" file is requested, and again Session_Start starts with the new SessionID ... I continue.
• All subsequent requests have answers, and the browser stops requesting "/favicon.ico".

I drew attention to each of the three generated SessionID, and it seems that the first one contains a browser. Therefore, when we go to step 6 above, and everything seems to work, it actually uses the very first SessionID that was generated.

So ... I decided to place the file "favicon.ico". I put the ico file in the root directory of the project and started a debugging session again. This time, Session_Start runs only once. "/favicon.ico" filed successfully (200).

So ... I think it works as it should in a sense ... But why do calls to /favicon.ico drive the Session_Start event ???? Should I have a choice not to post icons?

ASIDE: I tried everything above in an ASP.NET project (not mvc), and it did not have the same problem, although the favicon.ico file, hosted by default "ASP.NET Web Application", was missing, the project.

Answer 1

I think I got to the point that I have several solutions (although both seem to me to be “hacked”), so I think I agree with them and continue.

Got a comment from @Tz_ above mentioned, I have to ignore the route for favicon file. This is essentially what I will do. (kudos @Tz _!)

Moved to the next post (among others). It describes the problem, when the browser requests the file "/favicon.ico" from the ASP.NET MVC site, the MVC stack mistakenly tries to find and create an instance of the controller. I was not sure if this was true or not for my situation, but the answer suggested adding the following route entry:

routes.IgnoreRoute("favicon.ico"); 

I gave him a chance (added above) and fixed it!

So, I still don't know why the request /favicon.ico has an invalid identifier in MVC, but I know how to fix it in my situation. Or:

• The owner has an icon,
• or add an ignore route entry.

Again, both seem hacked to me, because I think this is what controlling factories should be able to handle gracefully. IMHO

Answer 2

I somehow had this problem, and finally, I realized that it happened because the http / https heanigans are happening ... it looks like it destroys and re-creates your session if you flip ssl the way you do, and you have

 <sessionState mode="InProc" sqlCommandTimeout="3600" timeout="120" cookieless="false" /> <httpCookies httpOnlyCookies="true" requireSSL="true" /> 

Perhaps a trap for new players or people who are really tired and do not pay attention! :) Just FYI in case this helps someone ...

Answer 3

I can not reproduce this problem. I tested on ASP.NET MVC 3 / Update Tool, Win08 / R2 / SP1 and Win7 / SP1 using IIS 7.5, Cassini and IIS Express. I see a favicon 404 request in Fiddler, but the breakpoint did not fall into favicon. I tested IE9, current FF and Chrome. Each time I click on a site with a new browser, Session_Start () is called, and I see a new session identifier. I work at Microsoft, so I would like to know how to reproduce this problem.

Answer 4

The reason you get Session_Start firing every time is because you have <httpCookies requireSSL="true" /> in <system.web> in your Web.Config delete this, and you're good to go.

Answer 5

This happened to me when I had a few <img> on the page with the wrong "src" attribute. Entering the correct path in "src" solved my problem.