Session Code needs Tidy Up ?

[fastbike]

Just looking at the session code I've noticed three things: the first two are minor code cleaning issues and the third may require a code change.

1. TWebContext.SessionStop has a Boolean param "ARaiseExceptionIfExpired" that is not used in the method.
   IMO this can be removed

2. TMVCEngine.GetCurrentSession has an Integer param "ASessionTimeout" hat is not used in the method.
   IMO this can be removed

3. TWebContext.SessionStop removes the session from the global session dictionary.
   In certain circumstances this (via the TDictionary notification process) this can call the destructor on the Context's TWebSession instance. However the private variable is now left dangling so the next time it is accessed it will cause an AV.
   This require some more work to provide a reproducible example

[fastbike]

I think the fix is as simple as replacing
SId := TMVCEngine.ExtractSessionIdFromWebRequest(FRequest.RawWebRequest);
GlobalSessionList.Remove(SId);

with
SId := SessionId
GlobalSessionList.Remove(SId);
if SId <> '' then
FWebSession := nil;

This ensures if there is an active session then that session id will be used, otherwise it will look in the request cookies

[danieleteti]

Thank you David, now it should be fixed.