How to prevent ashx from resetting Session Timeout?

Question

I'm having trouble finding any info on this, which makes me think I'm doing something wrong. I've made an ashx that serves up secured images to our logged-in users. The problem is that a Sql Profiler trace reveals that TempResetTimeout is called in our Session State DB for every image served via this mechanism. This ashx was built to replace an aspx that used to do the same thing but was causing many session state db deadlocks due to many images and web garden usage, yada, yada. This is definitely an improvement, due to one less "Read Committed" call to session state db, but the fact that there's an update means we can still have some deadlocks. Basically, we want NO session interaction at all from the use of this ashx, but that doesn't seem to be happening.

I certainly don't have the IRequiresSessionState interface implemented, so I am led to believe that my ashx should not touch Session in any way. I see Global.asax hit for every occurrence however, and Global.asax references session in some of its code. This led me to try to exclude this particular page from any sort of authentication via the following in web.config...

<location path="ImageHandler.ashx">
<system.web>
 <authentication mode="None" />
</system.web>
</location>

...but this causes the ashx to not fire at all (no image displayed and no breakpoint hit in ProcessRequest). I'm not sure why that is happening.

How can I get my ashx ImageHandler to not touch session AT ALL?

Answer 1

SessionState is set up on an Application level, so the only way to disable session for any ASP.NET request is to put it in its own Application in IIS and turn session state off.

<system.web>
    <sessionState mode="Off" />
</system.web>

http://msdn.microsoft.com/en-us/library/h6bb9cz9.aspx

You could also create your own session state module (perhaps trying to wrap the existing one), but that also would either require IIS configuration to set up another folder as an Application, or replacing it on your root application.

http://msdn.microsoft.com/en-us/library/system.web.sessionstate.sessionstatemodule.aspx

Though that just seems like a lot more effort than just turning it off for one subfolder that's configured as an Application in IIS.