title: ASP.NET session issues on a production server
body: <p>This is a pretty vague question as I've had no luck reproducing my issues outside of our production web server and am unsure if my two issues are even related.</p>
  
  <p>My application server is running Windows Server 2003 and is public-facing. The ASP.NET web application runs in .NET 3.5 and uses a (private) SQL Server (2008) on the LAN. The server running SQL Server also hosts SQL Server Reporting Services which are used in our web app via a page containing a MS ReportViewer control.</p>
  
  <p>The application used to run against .NET 1.1 and was migrated to 3.5 last year. The database was SQL Server 2000 and this was updated in a separate release early this year.</p>
  
  <p>I've encountered two strange problems in our deployment that <strong>must</strong> be configuration-based, but I've run out of suspects.</p>
  
  <p>Both problems relate to user sessions being lost.</p>
  
  <p>The first occurs in reporting and is triggered in the ReportViewer control. Infrequently, our users will try to manipulate a report (I've found one reproducible case for a particular user and report combination - an exception is always thrown when I try to change report pages).</p>
  
  <p>The exception call stack looks like this:</p>
  
  <blockquote>
    <p>Microsoft.Reporting.WebForms.AspNetSessionExpiredException: ASP.NET session has expired or could not be found
       at Microsoft.Reporting.WebForms.ViewerDataOperation..ctor()
       at Microsoft.Reporting.WebForms.ReportDataOperation..ctor(Boolean requiresFullReportLoad)
       at Microsoft.Reporting.WebForms.HttpHandler.GetHandler(String operationType)
       at Microsoft.Reporting.WebForms.HttpHandler.ProcessRequest(HttpContext context)
       at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
       at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously)</p>
  </blockquote>
  
  <p>The web app is configured to use InProc state storage, so a second IIS process wouldn't be able to locate the user's session - that's what this exception generally means, according to a few blogs I've read.
  I could see IIS funneling additional requests to another worker process... Except the site is configured to use a single process. This exception shouldn't be thrown - so either the IIS GUI tools are lying to me about the web app being configured as single-process, or the exception message isn't describing the real problem.</p>
  
  <p>I created a new application pool in IIS which is configured to recycle worker processes every 10000 requests and also at 2am. (The 10000 request rule is an old solution to resolve a problem that may or may not still exist - the problem and information on it predates me and I'm not inclined to experiment with it)
  In the performance tab, the Max number of worker processes is set to 1.</p>
  
  <p>The only fix I could come up with was to follow what the ReportViewer users have been saying, and that is to switch the state server mode from InProc to use an out-of-process serialization model. I chose the ASP.NET State Server.</p>
  
  <p>It works just fine on every server except production. When I turned it on on production, every user had this experience:</p>
  
  <p>1) Hit login page, enter credentials, log in
  2) Click any link from home page
  3) Booted back to log in screen. Re-enter credentials, log in.
  4) The site now works normally until the user logs out.</p>
  
  <p>Once again, this problem only existed on that production server and was not reproducible on my dev machine, our test server, or our public demo server.</p>
  
  <p>Are they related? Maybe, maybe not. With so little usable diagnostic information I've been left with few ideas. If anyone's hit anything like this or has an idea of a new path I can go down I'd really appreciate it.</p>