HttpContext.Current.Session is null + OWIN

Question

I am completely new to OWIN, and this problem was the main blocker for me.

Basically, in my MVC application, I have a class at startup:

public partial class Startup { public void ConfigureAuth(IAppBuilder app) { app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); app.UseCookieAuthentication(new CookieAuthenticationOptions()); app.UseOpenIdConnectAuthentication( new OpenIdConnectAuthenticationOptions { ClientId = OfficeSettings.ClientId, Authority = OfficeSettings.Authority, TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters() { RoleClaimType = "roles" }, Notifications = new OpenIdConnectAuthenticationNotifications() { AuthorizationCodeReceived = (context) => { // code hidden for readability if(HttpContext.Current.Session == null) { // It null. Why is that? } var session = HttpContext.Current.Session; if (session["myMockSession"] != null) { // Do stuff... } }, RedirectToIdentityProvider = (context) => { // code hidden for readability }, AuthenticationFailed = (context) => { // code hidden for readability } } }); 

I do not understand why, when I am debugging, that the session is null. The HttpContext.Current property is not. Are there any restrictions with Session + OWIN? Is there any workaround? How to approach him?

Lateral note 1: I tried to add this piece of code that I found in one of the SO questions, and Session was still null:

 app.Use((context, next) => { // Depending on the handler the request gets mapped to, session might not be enabled. Force it on. HttpContextBase httpContext = context.Get<HttpContextBase>(typeof(HttpContextBase).FullName); httpContext.SetSessionStateBehavior(SessionStateBehavior.Required); return next(); }); 

Side Note 2: I don't seem to be looking for this anymore, but someone suggested in one of the SO questions to add empty Session_Start and Session_End methods (as empty methods) to Global.asax. That didn't work either.

I welcome any advice. Thanks!

Answer 1

You almost . The reason your session is still zero is because you did not instruct OWIN to initialize System.Web sessions before your middleware runs.

By adding .UseStageMarker (..) after you register the middleware, you tell OWIN where in the execution progress bar it should execute SetSessionStateBehaviour

 app.Use((context, next) => { var httpContext = context.Get<HttpContextBase>(typeof(HttpContextBase).FullName); httpContext.SetSessionStateBehavior(SessionStateBehavior.Required); return next(); }); // To make sure the above `Use` is in the correct position: app.UseStageMarker(PipelineStage.MapHandler); 

By default, Owin middleware runs on the last event (PipelineStage.PreHandlerExecute), which in this case is too late for you.

Now, to use the sessions, you need to work with the middleware of the second one , which starts after the session has been included in the Asp.Net runtime. This middleware must be launched at the PostAquireState stage, for example:

 .Use((context, next) => { // now use the session HttpContext.Current.Session["test"] = 1; return next(); }) .UseStageMarker(PipelineStage.PostAcquireState); 

Asp.Net katana docs has about how middleware works. See Navigation Document> PiplineStage and HttpApplication docs for details on the execution order in Asp.net.