Session lost on postback using fully qualified domain name

See more:

C#

session

Currently have an web web form app that went to production recently and I noticed in the error logs that several "Object reference not set to an instance of an object." were being thrown. Of course this was one of those occurrences where I could never replication the issue, but I was finally able to by accident.

On several pages we store an object call CurrentProject into session.

private Project CurrentProject
{
    get { return HttpHelper.GetSessionVariable<Project>(Constants.SessionCurrentProject); }
    set { HttpHelper.SetSessionVariable(Constants.SessionCurrentProject, value); }
}

The HttpHelp Class:

public static class HttpHelper
{   
    public static T GetSessionVariable<T>(string key)
    {
        var session = GetSession();
        if (session == null)
            return default(T);

        var sessionVar = session[key];
        if (sessionVar == null)
            return default(T);
        return (T)sessionVar;
    }

    public static void SetSessionVariable<T>(string key, T value)
    {
        var session = GetSession();
        if (session == null)
            return;

        session.Add(key, value);
    }

    public static void RemoveSessionVariable(string key)
    {
        var session = GetSession();
        session.Remove(key);
    }

    public static void AppendQueryStringParameter(StringBuilder queryString, string parameterName, string parameterValue)
    {
        queryString.AppendFormat("{0}={1}", parameterName, HttpContext.Current.Server.UrlEncode(parameterValue));
    }

    public static T GetQueryStringParameter<T>(string parameterName)
    {
        string value = HttpContext.Current.Request.QueryString[parameterName];
        if (value == null)
            return default(T);
        return (T)TypeDescriptor.GetConverter(typeof(T)).ConvertFromString(value);
    }

    private static HttpSessionState GetSession()
    {
        if (HttpContext.Current == null)
            throw new ApplicationException("No Http Context exists. Unable to retrieve Session.");
        return HttpContext.Current.Session;
    }

    public static void ClearSessionSettings()
    {
        var session = GetSession();
        session.RemoveAll();
    }
}

And the sessionState element in web.config:

<sessionState cookieless="false" mode="InProc" timeout="20"/>

When I turned on the trace for the page I could see where the CurrentProject session variable was set, but on any I action that caused PostBack the session was cleared and I had a new session id.

I verified in the code that no session clear or abandon is called. The apppool is not resetting.

Now the odd thing. I only saw this when using the fqdn. I saw this on 3 different servers all running Wk28R2, Framework 4.5, and using Windows Authentication in the app.

The site is an application under the web root:

If I accessed the page at http://homeapps2/projectimprovement/projectedit.aspx I would never see this behaivoir. Only when using http://homeapps2.companyname.com/projectimprovement/projectedit.aspx I could produce the session loss everytime.

What was odd if I went to the page using the fqdn and hit F5 to refresh the page and then cause a postbaack everything would work as expected.

I should also mention that this behavior is only in IE. Even when running Fiddler to see if the session cookie was being set it would work.

Has anyone ever see this behavior?

What I have tried:

If I set the sessionsate to use URI I do not see this problem.

<sessionState cookieless="UseUri" mode="InProc" timeout="20"/>