Hi everyone.
I developed an SPA module with DNN API controller that uses Session. I thought each logged in user has their own Session object and data used by one user is not available for other users. But it appears that Session object is global and all the data stored in Session object is available for all users.

Is this done intentionally, or I have missed something in my configuration? This is how I enable session in my DNN API controllers:

public class ApiRouteMapper : IServiceRouteMapper
{
public void RegisterRoutes(IMapRoute mapRouteManager)
{
var route = mapRouteManager.MapHttpRoute("BillingSummary", "default", "{controller}/{action}", new[] { "Dnn.BillingSummary" });
foreach (Route r in route)
{
r.RouteHandler = new SessionBasedControllerRouteHandler();
}
}
}
public class SessionBasedControllerHandler : HttpControllerHandler, IRequiresSessionState
{
public SessionBasedControllerHandler(RouteData routeData) : base(routeData)
{
}
}
public class SessionBasedControllerRouteHandler : HttpControllerRouteHandler
{
protected override IHttpHandler GetHttpHandler(RequestContext requestContext)
{
return new SessionBasedControllerHandler(requestContext.RouteData);
}
}