Serious bug in SessionStateProvider

May 21, 2012 at 9:39 AM
Edited May 21, 2012 at 9:40 AM


I'm trying to use your SessionStateProvider implementation. I found a bug in several places, where you get the TimeOut number of minutes. Your code reads (line 312, GetItem method):

objItem = Common.CreateNewStoreData(context, _objConfig.Timeout.Minutes);

But Timeout.Minutes will return 0 in case that the timeout is set to 1 hour!

It should be:

objItem = Common.Deserialize(context, objHolder.Content, (int)_objConfig.Timeout.TotalMinutes);

This mistake repeats several time throughout the code.

This brings me to ask, has anyone used this library in production settings?


Shlomi Fruchter

Programmer @ TubeHero

May 21, 2012 at 7:07 PM

Depends on your definition of serious. All this will do is leaves item in the cache which will be ejected by the memcache after three days. Anyway this bug was reported while ago and is fixed in the branches/Suggested modification path. We have been using this code for over 4 year period in production with no issues. 
If you downloaded the Memcache provider release 1.2, this is few years old.


May 21, 2012 at 7:16 PM

Hi Fahad,

Thanks for your reply. The result in my case was that the item was immediately deleted from the DB, that's why I considered it serious.

I'm glad to hear that you use this in production for a long time. What version do you suggest that I use?



Jun 4, 2012 at 12:29 PM

Hi Fahad,

I'm a bit confused about which code version is the most updated and should be used.

Also, we're having a problem with the performance counters. Is there any way to disable them? I get exceptions in the case they are not existed.

I appreciate your help.