ASP.NET session lost but only for one particular user

Question

I have an ASP.NET application that is running on two load balanced servers. Everything is working fine except for one group of customers. All of these customers are coming from the same company. Randomly, an unhandled NullReferenceException error is thrown. It happens at random times in random places. It seems as if the session is just totally gone. since this is only happening for a specific group of users I have to assume that is has something to do with thier environment. I have seen users coming in with IE6, IE7, IE8 and FF and it the error occurs in all cases.

I am not 100% sure how to troubleshoot this. Does anyone have any ideas?

EDIT: Session is set to "InProc"

<sessionState mode="InProc" cookieless="false" timeout="20" />

Answer 1

If you're using SQL to store session state, check that all the servers in the farm are looking at the same SQL database - I've been caught out by this one before and it took quite a while to work it out!

Edit: Actually you might need to set it to StateServer as you're running in a web farm. See this about Session-State Modes from MSDN.

Answer 2

If your load balancing is based on directing every hit to the least-busy server, then InProc isn't going to work. you would need to use StateServer or SQLServer modes.

Imagine the first hit from a client is directed to server A - that starts a new session on server A. The second hit from the same client could go to server B, supplying the session cookie from server A which server B doesn't recognise.

If you have 'sticky' (or client affinity) load balancing, where the first hit is allocated to the least-busy server, but then subsequent hits from the same session are directed to the same server, then InProc should still work.

Answer 3

InProc session isn't shared between servers, so it sounds like this group of users is moving from one server to another and the others aren't. Maybe your load balancer is trying to achieve sticky sessions using something like IP address or whatever and this organisation is blocking that information.

Answer 4

I got in contact with the user that was having the porblem. I asked him to open a browser and go to whatsmyip.org and tell me what it says is his IP address. Then I asked him to refresh the screen a few times. Well, wouldn't you know it, the IP address changed. It kept switching between two different IP addresses. This was not the IP address of his machine but of two different proxies. Each request could come form one or the other apparently.

Our load balancer (something called Zeus - I am not a network guy) was set to estabilsh session affinity (a.k.a. sticky connections) using IP addresses. We changed the settings so that the load balancer would drop a cookie and use that to maintain the session and everything works correctly now.