Bug #47339 MySqlSessionStateProvider truncates sessions at 64 kb
Submitted: 15 Sep 2009 20:43 Modified: 18 Sep 2009 10:32
Reporter: Poul Bak Email Updates:
Status: Closed Impact on me:
Category:Connector / NET Severity:S2 (Serious)
Version:6.1.2 OS:Any
Assigned to: Vladislav Vaintroub CPU Architecture:Any
Tags: MySqlSessionStateProvider

[15 Sep 2009 20:43] Poul Bak
After installing and running MySqlSessionStateProvider I got an error saying that SessionState was corrupted.
It turns out that the data, I saved in Session vars, were truncated at 64 kb,
because you have chosen to use BLOB fields.
One of the main reasons to use MySqlSessionStateProvider instead of 'InProc' sessions is to save memory, so it seems wrong to limit sessions to 64 kb. That might have been a good choice 10 years ago, but today it's not. I think it's a wrong approach to create limitations that neither 'InProc' nor 'StateServer' have (I have not tried SqlServer, so I don't know if it has this limitation).

How to repeat:
Try to save a session var larger than 64 kb. When opening a new page, the provider will fail, saying the session data is corrupt (which is correct).

Suggested fix:
The fix is simple: Change the column's type to LONGBLOB !
Sure, each session will use 2 bytes more, so what?
[16 Sep 2009 7:35] Tonci Grgin
Hi Poul and thanks for your report.

I searched all over .NET docs but Microsoft is not keen on revealing the limitations in stuff they make...
However, I found that there are URL length and header size restrictions enforced by http.sys and ASP.NET. Size of data sent in additional custom header can not exceed 65,535 bytes, for example.

Now, I am setting this to "Verified" so Reggie can confirm or overrule my findings. Also, it might be a good thing to put such limitations into our docs.
[16 Sep 2009 10:59] Poul Bak
I have manually changed the coloumn's type to LONGBLOB and now I can save large values. So it seems it's only a limitation on the table you create.

As mentioned, both 'InProc' and 'StateServer' also allow large values, so it's not a limitation in Session itself.

Suggested fix still seems to be the right fix.
[16 Sep 2009 11:04] Tonci Grgin
Poul, thanks!
[17 Sep 2009 11:22] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:


775 Vladislav Vaintroub	2009-09-17
      Bug#47339 MySqlSessionStateProvider truncates sessions at 64 kb.
      changed column definitionfor SessionItems to LONGBLOB instead of BLOB.
[17 Sep 2009 12:15] Vladislav Vaintroub
pushed in 6.1.2 and trunk
[18 Sep 2009 10:32] Tony Bedford
An entry was added to the 6.1.2 changelog:

The MySQL Connector/NET Session State Provider truncated session data to 64KB, due to its column types being set to BLOB.