43

I was wondering if HttpContext.Session uses cookies to store data. A work colleague told me that in a mobi site, phones generally do not have cookies and therefore you don't have session. I always thought session is data that is stored on the server side and is not dependant on client side objects please explain if I am wrong.

I read this.

5 Answers 5

63

In ASP.NET; you have a Session cookie. This cookie is used to identify which session is yours; but doesn't actually contain the session information.

By default, ASP.NET will store session information in memory inside of the worker process (InProc), typically w3wp.exe. There are other modes for storing session, such as Out of Proc and a SQL Server.

ASP.NET by default uses a cookie; but can be configured to be "cookieless" if you really need it; which instead stores your Session ID in the URL itself. This typically has several disadvantages; such as maintence of links become difficult, people bookmarking URLs with expired session IDs (so you need to handle expired session IDs, etc). Most modern phones, even non-smart phones, support cookies. Older phones may not. Whether you need to support cookieless sessions is up to you.

If your URL looked like this:

http://www.example.com/page.aspx

A cookieless URL would look like this:

http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/page.aspx

Where lit3py55t21z5v55vlm25s55 is a session ID.

You can learn more about ASP.NET's session state here

1
  • 1
    So if you clear the cookies from the browser, what happens when you reuse the page (in terms of orphaned / new session / existing session parameters)?
    – SharpC
    Commented Dec 10, 2018 at 9:03
29

The session data is stored on the server, but it also stores an id string in a cookie to identify the user.

If cookies are not supported, the id string can't be stored, and the server can't pair the session when the user makes another request.

The session id is just a number generated by the server (either from a counter or randomly), so it doesn't contain any information from the data that you store in the session object.

(The application can also be configured to put the session in the URL instead of in a cookie. This enables you to use sessions without cookies, but it ruins your nice URLs.)

3
  • How could I configure my app to do this (session in url?)
    – David
    Commented Jul 14, 2011 at 8:24
  • 3
    @user351709: You use cookiless="true" in the sessionState section in your web.config file. msdn.microsoft.com/en-us/library/h6bb9cz9.aspx
    – Guffa
    Commented Jul 14, 2011 at 9:24
  • Since this question is about ASP, could the same principle be applied to PHP? Your answer made me understand how sessions work but I'm not sure if the concept is across the board and not just ASP-specific.
    – dokgu
    Commented Jun 22, 2018 at 20:07
19

Nowadays it can be both.

Server Session

Server Side session already explained in the others posts. The session is stored on the server but it need a cookie to store an indicator of who is requesting the session value.

Client Session

The new concept of WebStorage defined by W3C shows how a client side session is nowasays needed. Here is the HTML5 implementation of a WebStorage: https://code.google.com/p/sessionstorage/

1
  • For someone trying to reduce the server workload, client session is a good idea.
    – Rodrigo
    Commented Oct 21, 2015 at 12:28
3

This is a tricky question in some ways, as it is a bit of both.

The session state, itself, is stored on the server. But, you need some type of indicator on the client to use it. Normally, this is a server cookie, which is very thin and is basically a GUID for the session and nothing more. But, you can set up sites to pass the session ID in the URI, so it need not be a cookie.

Not sure how phones deal with the session cookie concept, but since I can log in, and do not see IDs in URIs, I assume there is a mechanism, even if it does not handle user cookies.

2

Session id is by defauld stored as cookie. You can also configure your session to pass its id as a query parameter ("cookieless").

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.