Asp.net

Session Object and SessionID

Reference : http://www.codeproject.com/Articles/32545/Exploring-Session-in-ASP-Net

What is Session?

Web is stateless, which means a new instance of a web page class is re-created each time the page is posted to the server. As we all know, HTTP is a stateless protocol, it can't hold client information on a page. If the user inserts some information and move to the next page, that data will be lost and the user would not be able to retrieve that information. What do we need here? We need to store information. Session provides a facility to store information on server memory. It can support any type of object to store along with our own custom objects. For every client, session data is stored separately, which means session data is stored on a per client basis. Have a look at the following diagram:

Fig: For every client, session data is stored separately

State management using session is one of the best ASP.NET features, because it is secure, transparent from users, and we can store any kind of object in it. Along with these advantages, some times session can cause performance issues in high traffic sites because it is stored in server memory and clients read data from the server. Now let's have a look at the advantages and disadvantages of using session in our web applications.

Advantages and disadvantages of Session?

Following are the basic advantages and disadvantages of using session. I have describe in details with each type of session at later point of time.

Advantages:

• It helps maintain user state and data all over the application.
• It is easy to implement and we can store any kind of object.
• Stores client data separately.
• Session is secure and transparent from the user.

Disadvantages:

• Performance overhead in case of large volumes of data/user, because session data is stored in server memory.
• Overhead involved in serializing and de-serializing session data, because in the case of StateServer andSQLServer session modes, we need to serialize the objects before storing them.

Besides these, there are many advantages and disadvantages of session that are based on the session type. I have discussed all of them in the respective sections below.

Storing and retrieving values from Session

Storing and retrieving values in session are quite similar to that in ViewState. We can interact with session state with the System.Web.SessionState.HttpSessionState class, because this provides the built-in session object in ASP.NET pages.

The following code is used for storing a value to session:

 Collapse | Copy Code

//Storing UserName in Session
Session["UserName"] = txtUser.Text;

Now, let's see how we can retrieve values from session:

 Collapse | Copy Code

//Check weather session variable null or not
if (Session["UserName"] != null)
{
    //Retrieving UserName from Session
    lblWelcome.Text = "Welcome : " + Session["UserName"];
}
else
{
 //Do Something else
}

We can also store other objects in session. The following example shows how to store a DataSet in session.

 Collapse | Copy Code

//Storing dataset on Session
Session["DataSet"] = _objDataSet;

The following code shows how we to retrieve that DataSet from session:

 Collapse | Copy Code

//Check weather session variable null or not
if (Session["DataSet"] != null)
{
    //Retrieving UserName from Session
    DataSet _MyDs = (DataSet)Session["DataSet"];
}
else
{
    //Do Something else
}

References:

• MSDN (read the session variable section)

Session ID

ASP.NET uses an 120 bit identifier to track each session. This is secure enough and can't be reverse engineered. When a client communicates with a server, only the session ID is transmitted between them. When the client requests for data, ASP.NET looks for the session ID and retrieves the corresponding data. This is done in the following steps:

• Client hits the web site and information is stored in the session.
• Server creates a unique session ID for that client and stores it in the Session State Provider.
• The client requests for some information with the unique session ID from the server.
• Server looks in the Session Providers and retrieves the serialized data from the state server and type casts the object.

Take a look at the the pictorial flow:

Fig: Communication of client, web server, and State Provider