NHibernate ISession in ASP.NET Core: DI scope vs CurrentSessionContext — which should own the session?

The Authoritative Session Strategy

To ensure a single authoritative ISession per HTTP request that is shared between constructor injection and legacy GetCurrentSession() calls, you should delegate the ICurrentSessionContext to the DI scope. Relying on the default NHibernate.AspNetCore middleware alone is risky because the identity of the session depends strictly on middleware execution order relative to service resolution.

The Core Conflict

In a standard AddNHibernate() setup, the DI container manages the ISession as a scoped service. Simultaneously, NHibernate's CurrentSessionContext manages a session in a separate internal storage (typically AsyncLocal). If the middleware that binds these two does not execute before your repositories are resolved, GetCurrentSession() may instantiate a second session, leading to SessionException errors during lazy loading or detached entity issues.

Recommended Implementation

The most robust approach is to implement a custom ICurrentSessionContext that resolves the session directly from the IHttpContextAccessor. This guarantees that GetCurrentSession() always returns the exact instance managed by the ASP.NET Core DI container.

1. Register ISessionFactory as a Singleton.
2. Register ISession as Scoped.
3. Implement a Custom Context: Create a class implementing ICurrentSessionContext that uses IHttpContextAccessor.HttpContext.RequestServices.GetService<ISession>() to return the current session.
4. Configure the Factory: Set cfg.CurrentSessionContext = new YourCustomContext() during the SessionFactory build process.

Behavior in Background Tasks

Because this approach ties the session to the HttpContext, it will fail in background services (e.g., IHostedService) where HttpContext` is null. For non-request work, you must:

• Manually create an IServiceScope.
• Resolve ISession from that scope.
• Avoid GetCurrentSession() in background threads unless you have manually bound the session to a scope-aware context.

Verification Steps

To verify the configuration is correct, perform the following check within a Controller action:

public IActionResult VerifySession(ISession injectedSession, ISessionFactory sessionFactory)
{
    var currentSession = sessionFactory.GetCurrentSession();
    bool isSameInstance = ReferenceEquals(injectedSession, currentSession);
    return Ok(new { isSameInstance });
}

If isSameInstance is false, your CurrentSessionContext is operating independently of the DI container.