---
title: Resolve web context
summary: Finds the current BOL web context from the best available source.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
operation_id: OP-04
trigger: Page handler selection
---

# Resolve web context

The BOL web context carries the user's current policy, claim, and application across the BOL applications. This operation chooses the first available source so the context follows the user from one application to the next.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-04 |
| **Trigger** | Page handler selection |
| **Inputs** | `BolContext` cookie, referring application, `WebContextId` form value, `cid` query value, session |
| **Outputs** | A `ContextHelper` assigned to `WebContext` |
| **Primary components** | `BolContextModel.OnPageHandlerExecuting` (through `TryGetContext`), `WebContextService.NewContext`, `RequestHelper` |
| **Entry point** | `src/BolMiddleware/Models/BolContextModel.cs` |

## Steps

1. Determine the session id. When the environment key `bolmiddleware:UseSessionCookie` is true, read it from the cookie named by `bolmiddleware:SessionCookieName`; otherwise use the request session id ([BR-BOLMIDDLEWARE-020](../business-rules.md#br-bolmiddleware-020-session-identifier-source-selection)).
2. If the `BolContext` cookie holds a context with content, use it ([BR-BOLMIDDLEWARE-001](../business-rules.md#br-bolmiddleware-001-web-context-resolution-precedence), [BR-BOLMIDDLEWARE-003](../business-rules.md#br-bolmiddleware-003-context-content-detection)).
3. Otherwise re-read the cookie once and use it when it now has content.
4. Otherwise, if the request has a referring application, call `GetContext(sessionId, applicationName)` on the BOL Context API through `WebContextService`.
5. Otherwise, if a `WebContextId` form value or a `cid` query value is present, call `GetContext(contextId)`.
6. Otherwise read the context from the session.
7. If none of the sources produced a context, call `NewContext(sessionId, applicationName)`, add the middleware session cookie, and set the `BolContext` cookie.
   - On API failure: the service logs and returns an empty result ([BR-BOLMIDDLEWARE-021](../business-rules.md#br-bolmiddleware-021-silent-failure-degradation)).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Handler selected]) --> S0[Determine session id]
	S0 --> D1{Cookie has content?}
	D1 -->|Yes| EndOk([Use context])
	D1 -->|No| D2{Referring application?}
	D2 -->|Yes| S2[GetContext by session and application]
	D2 -->|No| D3{cid or WebContextId?}
	D3 -->|Yes| S3[GetContext by id]
	D3 -->|No| D4{Session context?}
	D4 -->|Yes| S4[Read session context]
	D4 -->|No| S5[NewContext and set cookies]
	S2 --> EndOk
	S3 --> EndOk
	S4 --> EndOk
	S5 --> EndOk
```

## Failure and edge-case behavior

- A context id from the query string or form is accepted without an ownership check, so a user can load another context by guessing its id.
- `UseSessionCookie` and `SessionCookieName` are read through `IEnvironmentClient` on every request; missing-key behavior is unknown**.
- `GetFrameworkLoggingInfo` writes form, query, and context values to the log, which can include personal data.

> **Note:** Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Related documentation
- [Index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Dependencies](../dependencies.md)
- [Configuration](../configuration.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Service registration](../service-registration.md)
- [API reference](../api/index.md)

## Sources
- src/BolMiddleware/Models/BolContextModel.cs
- src/BolMiddleware/Services/Context/WebContextService.cs
- src/BolMiddleware/Services/Context/WebContextExtensions.cs
- src/BolMiddleware/Services/Request/RequestHelper.cs