Sessions

The AuthFeature (plugin) already enables the SessionFeature, but if you want to make use of sessions and don't want to enable the built-in Authentication, you will need to register it manually in your AppHost with:

Plugins.Add(new SessionFeature());

When the SesionFeature is enabled, a Global RequestFilter is added to ServiceStack to ensure that all requests have a Temporary ss-id and a Permanent ss-pid session cookies set. These Cookies just contain a unique Base64-encoded Guid. The ss-opts cookie just stores the users preference on whether they want their current session to be temporary or permanent (i.e. to Remember Me or not - Default is Temporary).

If you're interested in the implementation, all the source code for ServiceStack's Sessions are kept in the ISession, SessionFeature, SessionFactory, SessionExtensions and ServiceExtensions classes.

Can be used with any ICacheClient

ServiceStack's implementation of Sessions are clean, in that they work with all of ServiceStack's Caching Providers and are simply pointers to POCOs in your Cache.

For typed or Custom AuthSession the key is:

urn:iauthsession:{sessionId}

When using un-typed Session Bag the key is:

sess:{sessionId}:{key}

The general recommendation is to use typed sessions, which will give you type-safety benefits as well as being able to fetch your entire users session with a single cache call. If you use the dynamic/session bag then it will be a network call for each key accessed - although as caches are designed for fast-access, this isn't too much of a concern.

Using Typed Sessions in ServiceStack

An example of using Typed Sessions is in the Social Bootstrap Api demo where a CustomUserSession is defined as:

public class CustomUserSession : AuthUserSession {
	public string CustomId { get; set; }
}

By inheriting AuthUserSession you're able to keep all the users session together in 1 POCO, which allows you to access everything in 1 cache read or write.

To provide a typed, Convenient API for your service you can add the following to a base class, here's SocialBootstrapApi's AppServiceBase example:

public abstract class AppServiceBase<T> : ServiceBase<T> {
	//Injected in IOC - defaults to InMemory Cache if not defined in AppHost
	public ICacheClient Cache { get; set; } 

	private CustomUserSession userSession;
	protected CustomUserSession UserSession {
		get {
			if (userSession != null) return userSession;
			if (SessionKey != null)
				userSession = this.Cache.Get<CustomUserSession>(SessionKey);
			else
				SessionFeature.CreateSessionIds();
			var unAuthorizedSession = new CustomUserSession();
			return userSession ?? (userSession = unAuthorizedSession);
		}
	}

	protected string SessionKey {
		get {
			var sessionId = SessionFeature.GetSessionId();
			return sessionId == null ? null : SessionFeature.GetSessionKey(sessionId);
		}
	}
}

This will then enable you to access your users Session in your ServiceStack services with base.UserSession.

Sharing ServiceStack's Typed Sessions in MVC and ASP.NET

ASP.NET's XML-encumbered Session (old .NET 1.0) Provider model makes it difficult for any ASP.NET Web Forms or MVC to be able to share User Sessions with any other web service framework you have hosted with it. ServiceStack is able to get around ASP.NET's Session Provider's inherent limitations by providing its own de-coupled, clean, testable, dependency-free ICacheClient and ISession APIs - which all work simply together as they're just plain Guid Session Keys stored in Caches pointing to POCOs.

Typed Sessions in MVC

To make use of it in MVC, you effectively do the same thing, although this time you can simply inherit the existing ServiceStackController which has the above templated code in a generic MVC Controller Template:

public class ControllerBase : ServiceStackController<CustomUserSession> {}

From there it's just a basic property which you can use in your Controller or assign to your views like this:

public partial class HomeController : ControllerBase {
	public virtual ActionResult Index() {
		ViewBag.Message = "MVC + ServiceStack PowerPack!";
		ViewBag.UserSession = base.UserSession;
		return View();
	}	
}

Typed Sessions in ASP.NET Web Forms

It's the same thing in ASP.NET Web Forms although this comes in the form of a base ASP.NET Web Page which you get for free when you install ServiceStack via the ServiceStack.Host.AspNet NuGet package.

Using Dynamic / Untyped Sessions in ServiceStack

You can access the dynamic UserSession Bag in ServiceStack services via the base.Session property already built-in ServiceStack's ServiceBase base class, e.g:

base.Session["cart"] = new Cart { ... };
var cart = base.Session.Get<Cart>("cart");