Serialization exception in compiled dll

Question

I have inherited the ASP.NET e-commerce web application (C # code behind). We recently moved the servers, and this is somewhat difficult. I have very little experience setting up an IIS server and working with such large projects. Most of the problems are now fixed, but we are having problems with a decisive role, as the client is trying to make a payment.
When the client confirms the payment, the application detects the following error:

Unable to serialize the session state. In 'StateServer' and 'SQLServer' mode, ASP.NET will serialize the session state objects, and as a result non-serializable objects or MarshalByRef objects are not permitted. The same restriction applies if similar serialization is done by the custom session state store in 'Custom' mode. 

Stack trace:

 [SerializationException: Type 'PayerAuthentication.PayerAuthenticationServicePost' in Assembly 'PayerAuthentication, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' is not marked as serializable.] System.Runtime.Serialization.FormatterServices.InternalGetSerializableMembers(RuntimeType type) +7733643 System.Runtime.Serialization.FormatterServices.GetSerializableMembers(Type type, StreamingContext context) +258 System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.InitMemberInfo() +111 System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.InitSerialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter) +161 System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.Serialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter) +51 System.Runtime.Serialization.Formatters.Binary.ObjectWriter.Serialize(Object graph, Header[] inHeaders, __BinaryWriter serWriter, Boolean fCheck) +410 System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph, Header[] headers, Boolean fCheck) +134 System.Web.Util.AltSerialization.WriteValueToStream(Object value, BinaryWriter writer) +1577 

Google search results indicate that I should add [Serializable] to the declared class declaration, but this is in a compiled dll to which I do not have csproj. The code worked fine on the previous server, and I do not think that any changes were made to the code, only in web.config - what can I do?

The sessionstate section of the web.config file reads <sessionState mode="StateServer" />

UPDATE1 . Using Reflector, I exported the class above, made it serializable, recompiled and replaced the dll. The ordering process went through another step, where I encountered the same error for another compiled class. Once again, I was able to use Reflector to see the code, and then export it, edit it, and recompile it.
Now I have the same error:

 SerializationException: Type 'System.Runtime.Remoting.Messaging.AsyncResult' in Assembly 'mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' is not marked as serializable.] 

I'm not sure I can do anything about this, as this should be part of the .net system files! Any other ideas?

UPDATE2 : Ha, I subsequently discovered that it was processing payments correctly, but then threw the Unable to serialize the session state error above on System.Runtime.Remoting.Messaging.AsyncResult before the user received the transaction. Not good. Not sure how to move on ...

UPDATE3 . I tried to create a copy of the System.Runtime.Remoting.Messaging.AsyncResult class and make it serializable, but this leads to inconsistent accessibility issues.

 using System; using System.Runtime.InteropServices; using System.Threading; using System.Security.Permissions; using System.Runtime.Remoting.Messaging; [Serializable, ComVisible(true)] public class myAsyncResult : IAsyncResult, IMessageSink { // Fields private AsyncCallback _acbd; private Delegate _asyncDelegate; private object _asyncState; private ManualResetEvent _AsyncWaitHandle; private bool _endInvokeCalled; private bool _isCompleted; private IMessageCtrl _mc; private IMessage _replyMsg; // Methods internal myAsyncResult(Message m); //[SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.Infrastructure)] public virtual IMessageCtrl AsyncProcessMessage(IMessage msg, IMessageSink replySink); private void FaultInWaitHandle(); public virtual IMessage GetReplyMessage(); public virtual void SetMessageCtrl(IMessageCtrl mc); //[SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.Infrastructure)] public virtual IMessage SyncProcessMessage(IMessage msg); // Properties public virtual object AsyncDelegate { get; } public virtual object AsyncState { get; } public virtual WaitHandle AsyncWaitHandle { get; } public virtual bool CompletedSynchronously { get; } public bool EndInvokeCalled { get; set; } public virtual bool IsCompleted { get; } public IMessageSink NextSink { [SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.Infrastructure)] get; } } 

In particular, this is error CS0122: 'System.Runtime.Remoting.Messaging.Message' is inaccessible due to its protection level . I see this because Message is an inner class. But of course, I cannot change the accessibility level, because it is part of the System.Runtime namespace. And by making a copy and renaming it, will it fix the same problem again?

Can anybody help me?

FINAL UPDATE It seems, after all this, that it was an SSL certificate (see My answer below)

Answer 1

Now I believe that this problem arose when we installed the new SSL certificate.

The new certificate had extensions for zip codes that our HSBC payment merchant does not accept through the CPI payment gateway.

Getting the right SSL certificate seems to have finally resolved this issue.

Answer 2

If you really need code, you can try using the Reflector Class View. At the very least, this can help you check if [Serializable] part of the problem class definition or not.

Answer 3

You will need to find out if the new server is a later version than the old or the older one. If this is an older version, then upgrade it to a newer version and everything should work.

If it's newer, is this your code (do you have a source) that puts these non-serializable objects in session state? If so, then you can create your own class to mirror the properties of the old class. Make your serializable class and put an instance of your class in session state. Make an instance of the old class when you exit the session state.

Answer 4

If the code was previously used only by the state provider in memory, then it can be ... complicated. The bigger point is that the serialization process (via the BinaryFormatter , which uses the database state provider) requires the [Serializable] attribute if the default provider does not.

How much code can you change? Any of this? For example, can you change the code that puts things in / out of state? Perhaps you can use a separate (serializable) DTO with the necessary properties and translate between them with your own code.

Other parameters:

• return to the provider in memory (and goodbye to the cluster)
• write to a provider that does not use BinaryFormatter

I have some thoughts about the latter, but I doubt it would be trivial

Answer 5

If the question is how to make the application work without this error, a quick solution is to set the mode attribute of the sessionState element to "InProc".