Session State in .NET

Painting QR Code ISO/IEC18004 in .NET Session State

As I mentioned in the previous section, ASP.NET extends session state management with two new features:

Cookieless sessions When you enable this feature, the session ID token is burned into the URL instead of being stored in a cookie. This setting slows execuZ tion a little but ensures that your application works flawlessly even if the end user disabled cookie support in the browser. Out-of-process sessions ASP.NET can store session data in its process s memZ ory (the default behavior, the same as in ASP), in a separate process running as a Windows service, or in a SQL Server database. The last two options let you share session data among all the components of a Web garden or a Web farm, at the cost of slower execution.

You can combine these new features, if necessary, by having cookieless sessions whose data is stored in a Windows service or a SQL Server database. As in classic ASP, you can even disable sessions completely, either for individual pages or the entire application, to reduce memory consumption on the server machine. In addition, ASP.NET supports a new read-only mode at the page level, which enables you to improve the performance of individual pages that read but don t need to modify session variables. You enable most of the new session state features by setting one or more attributes in machine.config or in the web.config file stored in the application s root directory:

<configuration> <system.web> <sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;user id=sa;password=" cookieless="false timeout="20 />

26:

You can edit the web.config file right inside Visual Studio .NET. This file is automatiZ cally created with each new ASP.NET application, and it contains several sections with default settings and many remarks that explain how you can change them.

Enabling cookieless sessions is as simple as setting the cookieless attribute to true:

If you now run the application, you ll notice that the session ID is embedded in the URL and enclosed in parentheses. (See Figure 26-2.) Of course, all the hyperlinks embedded in the page take this extra item into account, as you see here:

Most of the time, you don t have to do anything else to leverage this feature. An exception to this laissez-faire practice is when you want to pass a URL to another application for example, an external component. In this case, you should build the URL properly to ensure that the correct session ID is found when the other component accesses the appliZ cation. You can test whether you re in a cookieless session by using the IsCookieless propZ erty and calling the Response.ApplyAppPathModifier method to produce the correct URL:

Dim url As String = /AnotherPage.aspx" If Session.IsCookieless Then url = Response.ApplyAppPathModifier(url) End If You can now safely pass the URL to another component.

Figure 26-2

Part VI:

To activate out-of-process sessions based on a Windows service, you must do two things. First, you must start the Windows service named aspnet_state, which is installed with ASP.NET. You can use the NET START command from the command prompt to begin aspnet_state:

In production sites, however, you ll probably want to run this service automatically when the server reboots. You can do this by setting the start-up type setting for this service to Automatic in the Properties window of the Services snap-in for Microsoft Management Console. (See Figure 26-3.)

Figure 26-3 The start-up mode for the aspnet_state Windows service should be set to Automatic in production sites.

The second step in activating out-of-process sessions is to modify the configuration file so that the mode attribute is set to the StateServer value and the stateConnectionString attribute points to the IP address and port of the machine on which the service is runZ ning. If the service is running on the local machine, you can use the loop-back address 127.0.0.1, but in real life this attribute will point to the one computer in the LAN that stores the session variables for all the other machines in the Web farm:

<sessionState mode="StateServer" stateConnectionString="tcpip=192.168.0.4:42424" cookieless="false timeout="20 />

By default, the aspnet_state service listens to port 42424, so this is the port number you specify in the stateConnectionString attribute. (And you can omit it if you want.) You can configure the service to use a different port by editing the Port value under the

26: