Sharing Session State across different zones in web applications

Question

We have a SharePoint 2010 web application with kind of e-commerce functionality (for example, http://sharepoint-shop). User can save items in the basket which works through default Session State (HttpContext.Current.Session).

Anonymous users can do this too. They pick up the items same way, but before order-workflow is starting user must log in. After this browser redirects user to HTTPS zone (https://sharepoint-shop) and all session data disappeared (HttpContext.Current.Session).

Any ideas, How I can share this session data between multiple zones?

Answer 1

The answer was quite simple.

I tried to understand how works a mechanism for storing sessions in ASP.NET. In my case, the sessions stores in the SQL Server database SessionStateService_bf7ce9929397425d9b58d03b91699180 (default provision). This database contains two tables ASPStateTempApplications and ASPStateTempSessions. If you look at this tables you can see the main idea why diffirent applications has diffirent sessions. SessionId column consist of two parts: %SESSION_ID% (HttpContext.Current.Session.SessionID) and second part is the app-hash. App hash is unique for each applications, actually it is hash-function of two variables: AppId and MachineName. AppId generated by dbo.TempGetAppID stored procedure, MachineKey is property of each web.config (or machine-level machine.config).

So all you need to fix the stored procedure and web.config. I added to the dbo.TempGetAppID procedure this line at start:

SET @appName = 'singlesession'

Then I provided same validation and decryption keys in the <machineKey/> config section of web.config for both zones - "http" and "https".

So I got single HttpContext.Current.Session for each web-applications.