{"id":5755,"date":"2017-01-19T19:43:44","date_gmt":"2017-01-19T19:43:44","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/premier_developer\/?p=5755"},"modified":"2019-02-14T20:27:42","modified_gmt":"2019-02-15T03:27:42","slug":"asp-net-session-swapping-why-it-happens-and-what-can-be-done-about-it","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/premier-developer\/asp-net-session-swapping-why-it-happens-and-what-can-be-done-about-it\/","title":{"rendered":"ASP.Net Session Swapping \u2013 Why it happens and what can be done about it?"},"content":{"rendered":"

In this post, Senior Application Development Manager, Sanket Bakshi<\/a> explains details behind the sometimes perplexing issue of Session Swapping and how to avoid it.<\/p>\n

\n

\"image\"<\/a>Kernel Cache is a powerful and well-known feature introduced in IIS 7 and found in all later versions.\u00a0 It\u2019s the highly performant server level cache that very efficiently delivers frequently used content.\u00a0 Since the cache is in kernel memory, it is served even before the request reaches the IIS pipeline and, hence, it\u2019s lightning fast.\u00a0 The problem arises with ISAPI components if they are attaching session cookies on the content in Kernel cache,<\/em> then it is possible to run into a “session-swap” issue.\u00a0 In other words, a session for userA gets assigned to userB.\u00a0 This issue can happen on IIS 7 onwards including IIS 8 and IIS 8.5 versions.<\/p>\n

Kernel cache has a very strict policy for what gets stored in this cache and how it gets scavenged<\/a>.\u00a0 If any content that meets this criteria also has the session cookies attached to it by an ISAPI component, then content still gets cached.\u00a0 The subsequent requests from other users will find the content in the session cache and in process will also get the session cookies for the other user.\u00a0 That\u2019s the mechanism for session swap.\u00a0 This does not happen for managed components since <\/em>IIS can better track how managed components are manipulating responses. Hence, if any managed component attaches a session cookie to a content that can potentially be stored in the kernel cache, that response content does not get stored in the kernel cache. However,\u00a0 ISAPI components are not cache aware and hence the issue.<\/p>\n

The guidelines for ISAPI components regarding the kernel cache suggest that components either make themselves cache-aware by using the FilterEnableCache metabase property<\/a> or disable caching for a specific response each time they perform a set-cookie operation on the response. This becomes tricky when using third-party components since you don\u2019t have control of the ISAPI source code.\u00a0 The only option in that case is to disable the Kernel mode cache.<\/p>\n

Disabling the kernel cache is a configuration change.\u00a0 If it is not locked at the applicationhost.config level, the applications can choose to override.\u00a0 In a multi-tenant environment, you might wonder about how to determine if any applications accidentally enable this?\u00a0 Kernel cache provides a set of performance counters<\/a> that can be monitored for any such activity.\u00a0 It\u2019s important to note, however, the kernel cache is controlled by http.sys so restarting IIS does not have any impact on the values of the performance counters. It is quite possible to keep seeing stale values in the performance counters even when the kernel cache is disabled, misleading you to believe that the cache is still being utilized.\u00a0 When tracking the perfmon data, it will also be observed that when performing an IIS reset, the aggregate counters such as Total URIs cached, Total Hits, Total Misses etc will go down to zero momentarily and then bounce back the original stale values.\u00a0 Since the kernel cache is being handled by http.sys and this driver is never restarted, the aggregate counters never lose their values.<\/p>\n

Perfmon counters interact with the IIS Admin Service for monitoring purposes.\u00a0 Since an IIS Reset causes this service to stop and restart, perfmon is not able to read the counter values during that time and hence the momentary zero values.\u00a0 This does not indicate any changes in the actual values of the counters, rather, that the values were simply not availably for that time when the admin service was restarting.\u00a0 Restarting the HTTP service using the \u201cNET STOP HTTP\u201d command will reset these counters to zero.<\/p>\n

As an effective monitoring strategy for identifying Kernel cache usage, it is recommended that teams monitor the \u201cCurrent URIs cached\u201d performance counter and alert if the value for this counter goes above zero.\u00a0 The other counters specified here<\/a> can be tracked for post-mortem purposes.\u00a0 Typical monitoring products such as Systems Center Operations Manager<\/a> can be used to monitor and alert on these performance counter values.<\/p>\n

\n

Premier Support for Developers<\/strong><\/a> provides strategic technology guidance, critical support coverage, and a range of essential services to help teams optimize development lifecycles and improve software quality.\u00a0 Contact your Application Development Manager (ADM) or email us<\/a> to learn more about what we can do for you.<\/p>\n","protected":false},"excerpt":{"rendered":"

In this post, Senior Application Development Manager, Sanket Bakshi explains details behind the sometimes perplexing issue of Session Swapping and how to avoid it. Kernel Cache is a powerful and well-known feature introduced in IIS 7 and found in all later versions.\u00a0 It\u2019s the highly performant server level cache that very efficiently delivers frequently used […]<\/p>\n","protected":false},"author":582,"featured_media":37840,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[80],"tags":[67,58,3],"class_list":["post-5755","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net","tag-asp-net","tag-security","tag-team"],"acf":[],"blog_post_summary":"

In this post, Senior Application Development Manager, Sanket Bakshi explains details behind the sometimes perplexing issue of Session Swapping and how to avoid it. Kernel Cache is a powerful and well-known feature introduced in IIS 7 and found in all later versions.\u00a0 It\u2019s the highly performant server level cache that very efficiently delivers frequently used […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/5755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/users\/582"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/comments?post=5755"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/5755\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media\/37840"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media?parent=5755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/categories?post=5755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/tags?post=5755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}