Method GetSessionAsync

GetSessionAsync(TSessionToken, CancellationToken)

Gets the session that the specified session token belongs to, or null to end the session.

Declaration

Task<SessionLookupResult<TSessionToken>?> GetSessionAsync(TSessionToken sessionToken, CancellationToken cancellationToken)

Parameters

Type	Name	Description
TSessionToken	sessionToken	The session token from the session cookie.
CancellationToken	cancellationToken	A token to cancel the operation.

Returns

Type	Description
Task<SessionLookupResult<TSessionToken>>

Remarks

This is called when the session cookie is due for a refresh (see RefreshAfter), when a request forces validation (see ForceValidate), and when a SignalR connection's session is rechecked. A null result ends the session: the request continues without a session and the session cookie is cleared, except that a browser's request keeps a cookie that was due. InvalidateSessionAsync(TSessionToken, CancellationToken) is not called for it.

If the result has a ReplacementToken, the session continues with that token: the request gets it, and the session cookie is reissued with it.

An UnauthorizedApiException thrown by this method ends the session with a reason: InvalidateSessionAsync(TSessionToken, CancellationToken) is called, the session cookie is cleared and the exception propagates to the request, which reports it to the client. In a SignalR connection or a streaming response that has started, the cookie can no longer be cleared, so only the exception reaches the client. A SignalR connection whose session is rechecked is closed with the exception (see RevalidateHubConnections).

It is also called at the start of a response that reissues the session cookie without a refresh, such as with a replacement token, to check that the session still exists. There, a null result or an exception only skips the reissue: a replacement token is ignored, and InvalidateSessionAsync(TSessionToken, CancellationToken) is not called.