Understand ASP. NET_SessionId,

Understand ASP. NET_SessionId,

 

I believe that programmers who develop apn.net web are familiar with ASP. NET_SessionId. ASP. NET_SessionId is saved in the browser cookie. So where does it come from? When? When will it expire? What is the function?

With these questions, we began to explore it. Practice is the best way to test truth.

Open VS to create an APS. net mvc program, and add the following code on the HOME page:

ClearSession and clearSessionId are requested by ajax instead of refreshing the page. The corresponding background method is as follows:

The corresponding action code is as follows:

When the parameter user is not blank, we create a session to save it.

Now let's debug and run F5 to see the effect:

Continue F5 refresh the browser:

The previous two refresh browser Session ["user"] is Null, but ASP. NET_SessionId changes. The value of the third parameter user will be stored in the background using session. For example:

We can see that for the third time, after we pass the value, the session called in the background is stored, and then the server assigns this request a sessionid different from the previous two. Then the browser obtains the sessionid. Will the fourth request carry it with it? Can the server recognize it? Does sessionid change? Refresh the page immediately and reveal the answer:

Clearly, for the fourth access, the request header carries the sessionid, and the fourth session ID is the same as the third session. Continue to refresh, and it will not change !!

It is easy to conclude that for the first two requests, the sessionid is not contained in the request header initiated by the browser. Then the server will think that the request is new and a new sessionid will be assigned to the request. If the session operation is not used for this access

The server considers the sessionid invalid. To save resource overhead, the server does not record the sessionid. The sessionid is not stored in Response. Cookies. Only after the session is saved for the third time can the server deem it valid and record the third session ID,

And return it to the browser, and access it using cookies as creden。 for the next access.

For the fourth time, there is already a sessionid in the request, and the request is sent to the server with the sessionid. If the server finds the sessionid, It is indexed to its own record and found to be a valid sessionid, the sessionid is no longer assigned to the request. Therefore, the sessionid remains unchanged after the third time.

After understanding this, you will ask, when will the sessionid expire? Under which conditions does it expire?

Since sessionid is generated only when session is used, will the sessionid become invalid if session is cleared?

, Click Clear session and refresh again:

As you can see, the 8th session has been cleared, but the sessionid still exists and remains unchanged. It can be seen that the life cycle of sessionid is not "Same as that of session ".

The default validity period of a session on the server is 30 minutes. If a request with the sessionid is sent within the last 30 minutes, the session will be postponed. If we close the browser during this timeSessionid disappears immediately, and the server allocates a newSessionid. PreviousSessionid still exists on the server,

Will be destroyed by the system due to expiration time to clear the resource space.

To verify the preceding view, click the clear sessionid button to manually clear the browser.Sessionid.

 

Refresh again

Sessionid has been reassigned ~~~

Okay, after work, let's talk about it here ~~~