Should a web site's business layer access the session state?

Question

I am working on maintaining an ASP.NET website, and I've noticed the business layer and other supporting libraries make heavy use of HttpContext.Current.Session. This makes it hard to keep track of session variables, to determine what they're used for and why they even exist.

Is it considered bad practice to use the session in the business layer? And would it be wise to start moving all code that uses the session into the code-behind?

Answer 1

Yes - the BL should not have any knowledge about the Session. Its a dependency that you don't need.

Answer 2

make a class that is an indirection, in which case on the web it may return values from HttpContext.Current.Session, and in other areas would resolve that from somewhere else. IE have an interface ISessionStore and have concrete classes WebSessionStore and WindowsFormsSessionStore, etc.

this will make your code easier to test and also gives you expansion paths when say, you now want x business logic to run in a windows service where it can run x piece of code every y minutes.

Answer 3

I follow this rule - any class in System.Web namespace (javax.servlet package in Java) should not be present in your business layer.

Answer 4

It's almost never a good idea. There's lots of reasons, but here's a couple:

• you'll never be able to use business layer code in anything other than ASP.NET
• Unit Testing becomes much more of a pain or even impossible.

We ran into huge headaches with this exact same situation when we started to build services that utilized common business layer code.

Answer 5

In my opinion it is bad practice.

It makes it pretty hard to dissociate that business layer from the environment. If you expect to unit test the thing for example, you're out of luck.

One way to take care of that simply would be to insulate this into an abstraction for now, so that you can pass a "state cache" around and not refer to HttpContext. That will take you at least to some degree of abstraction. Another more interesting question is, why does the business layer need to refer to that?

Answer 6

its always better to have a centralized Cache/Session manager which encapsulates the complete interaction with session/cache or whatever persistence method you use. having your BL to interact with sessions is definitely a very bad practice and in a way defeats the purpose of the tiered architecture altogether.