Is there any way to modify App_Code in an ASP.NET application without losing session state?

Question

We have an ASP Web-Forms site that we update frequently.

However, any time we modify any classes stored in the App_Code folder, this causes an App Pool Recycle and loses all of our session state, causing our users to be logged out.

This means that any time we need to make changes in app code it needs to be around 2:00 in the morning to minimize user impact.

Now, since I value my sleep I was wondering if there is any workaround for this behaviour?

I've tried switching the application to use StateServer mode for Session State.

This seems to work as long as the class being changed is not currently in use. However if the class is in use it results in every-bodies session being lost.

What is best practice in this case for a heavily used website?

Am I condemned to late nights every time we need to fix a bug in our classes?

Thanks in advance for any response...

Answer 1

You will need sessionState setting cookieless="false" in addition to mode="StateServer".

In addition you need a fixed machine key, so a recycle won't generate a new machine key but uses the same key. If a new key is generated all previous sessionIds can't be decrypted, so the link to the sessionState is lost.

Check https://technet.microsoft.com/en-us/library/cc755177(WS.10).aspx for how to configure/generate a machine key.

This is an example from msdn, so don't use this in production, but generate your own key:

<machineKey 
validationKey="32E35872597989D14CC1D5D9F5B1E94238D0EE32CF10AA2D2059533DF6035F4F" 
decryptionKey="B179091DBB2389B996A526DE8BCD7ACFDBCAB04EF1D085481C61496F693DF5F4" 
/>

In the end you need something like this in your Web.config or your Machine.config if you want to set the same key on machine level.