asp.net (C #) Some misunderstandings about session operation _ practical skills

1. This. session["username"] = null
HttpSessionState internally uses a nameobjectcollection type of collection object to store user data. So use this. session["username" = null simply sets the value of the element to null and does not actually remove it from the session. Why Halo ~ ~ ~ ~ suggest a look at C # Basic Books. )

The correct approach is: this. Session.remove ("username");
Delete all data: this. Session.removeall (); or this. Session.clear ();

2. This. Session.Abandon ()
This method causes the current session to be canceled, and the system triggers the Session_End event in the global.asax (Mode = InProc only).
Although SessionID (possibly) did not change when the request was made again, you will find that the Global.asax Session_Start event is triggered. You can also use this. Session.isnewsession property to determine whether the current session was re-created.

Because some components and controls might want to use session information, such as using this. Session.syncroot, so do not easily use this method to clean up sessions.

3. User authentication
Do not use this. session["username"] = "Zhangsan", if (this. session["username"]!= null) in such a way as to authenticate users, which is neither secure nor reasonable. For authentication, refer to the MSDN documentation or related articles on rain marks.