静态Session类致客户信息串流问题及解决方案咨询

你完全找对了方向——静态类MySession就是导致客户信息串流的核心原因。在ASP.NET运行环境中，静态类的成员是应用全局共享的，所有访问网站的用户都会共用同一组静态属性的值。当客户A的请求把自己的姓名、地址存入这些静态属性后，后续客户B的请求读取的就是客户A留下的数据，自然就出现了串流问题。

解决思路与具体实现 #

1. 替换静态类为ASP.NET原生Session存储

我们需要把全局共享的静态属性，改成基于每个用户独立的Session对象来存储。可以封装一个工具类来简化Session的存取操作，避免直接到处写HttpContext.Current.Session：

public static class MySession
{
    // 定义Session键名，避免硬编码
    private const string BranchNumberKey = "Session_BranchNumber";
    private const string AccountNumberKey = "Session_AccountNumber";
    private const string NameKey = "Session_Name";
    private const string CustomerEmailKey = "Session_CustomerEmail";
    private const string StreetKey = "Session_Street";
    private const string ZipKey = "Session_Zip";
    private const string Zip4Key = "Session_Zip4";
    private const string TotalBalanceKey = "Session_TotalBalance";
    private const string BudgetBalanceKey = "Session_BudgetBalance";
    private const string BudgetRateKey = "Session_BudgetRate";
    private const string CorporationIdKey = "Session_CorporationId";

    // 封装每个属性的Session存取逻辑
    public static string BranchNumber
    {
        get => HttpContext.Current.Session[BranchNumberKey] as string;
        set => HttpContext.Current.Session[BranchNumberKey] = value;
    }

    public static string AccountNumber
    {
        get => HttpContext.Current.Session[AccountNumberKey] as string;
        set => HttpContext.Current.Session[AccountNumberKey] = value;
    }

    public static string Name
    {
        get => HttpContext.Current.Session[NameKey] as string;
        set => HttpContext.Current.Session[NameKey] = value;
    }

    public static string CustomerEmail
    {
        get => HttpContext.Current.Session[CustomerEmailKey] as string;
        set => HttpContext.Current.Session[CustomerEmailKey] = value;
    }

    public static string Street
    {
        get => HttpContext.Current.Session[StreetKey] as string;
        set => HttpContext.Current.Session[StreetKey] = value;
    }

    public static string Zip
    {
        get => HttpContext.Current.Session[ZipKey] as string;
        set => HttpContext.Current.Session[ZipKey] = value;
    }

    public static string Zip4
    {
        get => HttpContext.Current.Session[Zip4Key] as string;
        set => HttpContext.Current.Session[Zip4Key] = value;
    }

    public static string TotalBalance
    {
        get => HttpContext.Current.Session[TotalBalanceKey] as string;
        set => HttpContext.Current.Session[TotalBalanceKey] = value;
    }

    public static string BudgetBalance
    {
        get => HttpContext.Current.Session[BudgetBalanceKey] as string;
        set => HttpContext.Current.Session[BudgetBalanceKey] = value;
    }

    public static string BudgetRate
    {
        get => HttpContext.Current.Session[BudgetRateKey] as string;
        set => HttpContext.Current.Session[BudgetRateKey] = value;
    }

    public static Guid CorporationId
    {
        get => HttpContext.Current.Session[CorporationIdKey] is Guid id ? id : Guid.Empty;
        set => HttpContext.Current.Session[CorporationIdKey] = value;
    }
}

2. 确认Session功能正常启用

检查你的Web.config文件，确保Session是启用状态（默认是启用的，但如果有自定义配置需要确认）：

<system.web>
    <!-- Session配置，默认InProc模式适合小型应用，分布式场景可改用StateServer/SQLServer -->
    <sessionState mode="InProc" timeout="20" />
</system.web>

3. 清理残留的静态类隐患

删除原来的静态属性定义，确保整个项目中不再使用旧的全局静态成员，避免残留数据导致的问题。

4. 验证现有逻辑

你的CreditCard Action中的模型填充逻辑不需要修改，只要MySession现在是基于用户Session的，每个用户就能正确获取到自己的会话数据：

public ActionResult CreditCard() { 
    if (MySession.CorporationId == Guid.Empty || string.IsNullOrEmpty(MySession.AccountNumber)) { 
        return View("Index"); 
    } 
    var model = new Models.HomeModels.CreditCard(); 
    model.NameOnCard = MySession.Name; 
    model.Street = MySession.Street; 
    model.ZipCode = MySession.Zip; 
    model.PaymentAmount = MySession.TotalBalance.Contains("-") ? "" : MySession.TotalBalance; 
    if (MySession.BudgetBalance.GetNumericValue() > 0 && MySession.BudgetRate.GetNumericValue() > 0) { 
        model.PaymentAmount = MySession.BudgetBalance; 
    } 
    return View("CreditCard", model); 
}

关键原理补充 #

ASP.NET的Session对象是用户级别的隔离存储，每个用户访问网站时，服务器会为其分配一个唯一的SessionID，所有存入Session的数据都会和这个ID绑定，不同用户的Session数据完全独立，不会互相干扰。而静态类是应用级别的共享资源，所有用户共用同一个实例，这也是为什么会出现信息串流的根本原因。

内容的提问来源于stack exchange，提问作者ErocM