WCF sessions are not specific to specific user

Question

WCF function

    public void SetSession(string name)
    {
            HttpContext.Current.Session["abc"]=name;
    }
    public string GetSession(string name)
    {
            return HttpContext.Current.Session["abc"].ToString();
    }

Proxy

     using (ServiceReference1.BlackjackClient proxy = new ServiceReference1.BlackjackClient())
        {
            proxy.SetSession("Hello");
        }

my problem is when multiple clients are accessing the service then last set session is accessed by the each client. Session are not browser request based and not recognizing the client. Which client has sent which request. What should i do to make them specific to each client. means each client must have his own session.

Please help

Answer 1

The service can not know which client is calling the service. Regular asp.net use of Session uses a cookie, that identifies each request and makes some internal voodoo to map the request to the correct session.

In your case, you would have to either use login from the clients to ensure that the service could identify requests, but this would not in it self solve the problem.

Since you have access to the service implementation the simplest solution would probably be to store a session identifier (a Guid) in the client, and then send this along each request to the web service thus altering

    public void SetSession(string name)
    {
            HttpContext.Current.Session["abc"]=name;
    }
    public string GetSession(string name)
    {
            return HttpContext.Current.Session["abc"].ToString();
    }

to something like

public void SetSession(string name, Guid sessionId)
{
        HttpContext.Current.Session[sessionId + "_abc"]=name;
}
public string GetSession(string name, Guid sessionId)
{
        return HttpContext.Current.Session[sessionId + "_abc"].ToString();
}

Modifying the method signature like this is rather ugly though, but the idea would be, that the client aids the server in identifying the caller and thus the session.

It would be cleaner to use the transport protocol to identify the caller, so if you are creating a HTTP service, you could use some http header (perhaps authorization) to contain the session identifier. If you are using SOAP the message header could contain identical information.

The session identifier could also be created at the service by a new method named something like Guid CreateSession(). But a Guid could as well be created in the client.

But again: You will need to store some unique session id or user credentials in the client and communicate them to the server in each request.