Understanding the session Status of Asp.net

I. session Status

HTTP is a stateless protocol, so it does not automatically indicate whether a request sequence comes from the same client, or even not
Whether a single browser instance is still active in viewing a page or site. With the built-in session Status function of ASP. NET, we can use
1. logical application from a single browser client to the serverProgramAutomatically identifies and classifies Session requests.
2. Store session-range data on the server for cross-browser requests.
3. Trigger appropriateCodeSession lifetime management events (session_onstart, session_onend, etc)

Ii. session Status Identification
When creating a session, the server generates a separate identifier for each session. This ID is represented by a 120-bit sessionid string,
This string only contains the ASCII characters allowed in the URL. Sessionid is used to ensure uniqueness and randomness.AlgorithmGenerated,
The purpose of ensuring uniqueness is to ensure that sessions do not conflict with each other. The purpose of ensuring randomness is to ensure that malicious users cannot use new
To calculate the sessionid of an existing session.

Iii. session state storage
Three storage methods are available for session status.
1. In-process session Status mode (inproc): the default in-process session Status mode is used when a web program is created.
It is also a common model. In this mode, the session state is stored in the local ASP. NET auxiliary process.
Before, in-process
Session status mode may be the fastest access option. However, the more data stored in sessions, the more memory the Web server consumes.
This potentially increases the risk of performance reduction.

2.. Net status server mode (StateServer): The session status is stored in a remote process (for example, called aspnet_state.exe
In the indows NT Service)

3. SQL mode (sqlserver): Session status is stored in a dedicated database table managed by SQL Server.

Both the. Net status server mode and the SQL mode can be called the out-of-process session mode. When storing data, you need to serialize and store the data.
To the external repository, when reading and data, You Need To deserialize the data and copy it to the local session dictionary. Therefore, the request causes performance degradation.
From 15% (out-of-process) to 25% (SQL Server ). Note that this is just a rough estimate. However, in the out-of-process storage solution, session-like
Because it can prevent Microsoft? Internet Information Service (IIS) and
ASP. NET failed. By separating session states from applications, you can also easily extend existing applications to Web farm
And web garden architecture. In addition, the session status is stored in external processes, which fundamentally eliminates
The risk of periodic data loss.

Iii. session Status Configuration

The session state configuration is implemented by setting the <sessionstate> section of the web. config file. The following describes the details of the three session states.
Configuration method
1. In-process mode
In-process mode is the default session Status mode. To use the in-process mode, set the mode attribute of the <sessionstate> element.
Is inproc.
The following shows a configuration setting example of the In-process mode.
<Configuration>
<System. Web>
<Sessionstate mode = "inproc"
Cookieless = "false"
Timeout = "20"/>
</Sessionstate>
</System. Web>
</Configuration>

2. Status Server Mode
To use a status server, you must first ensure that the ASP. Net status service runs on the remote server used for session storage. This service and
ASP. NET and Visual Studio. NET are installed in the following locations:
Systemroot \ Microsoft. NET \ framework \ versionnumber \ aspnet_state.exe
Then, in the web. config file of the application, set the mode attribute of the <sessionstate> element to StateServer. Last
Set the connectionstring attribute to TCPIP = servername: portnumber.
The following is a configuration setting example of the Status server mode.
<Configuration>
<System. Web>
<Sessionstate mode = "StateServer"
Stateconnectionstring = "TCPIP = dataserver: 42424"
Cookieless = "false"
Timeout = "20"/>
</Sessionstate>
</System. Web>

3. SQL Server Mode
To use SQL Server, run installsqlstate. SQL on the SQL server computer that stores the session status.
Or installpersistsqlstate. SQL. Both scripts create a database named aspstate, which contains several stored procedures.
The difference between the two scripts lies in the location of the aspstatetempapplications and aspstatetempsessions tables.
The installsqlstate. SQL script adds these tables to the tempdb database, which will lose data when the computer restarts.
On the contrary, the installpersistsqlstate. SQL script adds these tables to the aspstate database, which allows
Session data is retained at the new startup.

By default, both script files are installed in the following locations:

Systemroot \ Microsoft. NET \ framework \ versionnumber

Then, in the web. config file of the application, set the mode attribute of the <sessionstate> element to sqlserver. Most
Then, set the sqlconnectionstring attribute to integrated security = sspi; Data Source = servername ;.

The following shows an example of configuration settings in SQL Server mode.

sqlconnectionstring = "Integrated Security = sspi; Data Source = dataserver; "
cookieless =" false "
timeout =" 20 "/>

In SQL SERVER mode, you can also set the session status to work in the Failover group. The failover cluster is two or more
For the same redundant Web servers, they store session data in an SQL Server database on a separate computer. If
When one Web Server fails, another server in the cluster takes over its work and provides services for requests, so session data will not be lost.
To configure a Failover cluster, set the <machinekey> element in the web. config file of the Web server to the same value.
Then, set the SQL connection string of the Web server to point to the SQL Server database that stores session data on the computer.

Iv. session Status access

You can directly access the session status through the session set. To be compatible with earlier versions of ASP, you can use the session. Contents attribute on the program object to access the session status.
the following example shows how to write two values to the session set on the first page, and then read the session set on the second page. Note:
the Page code is omitted here.
the first webpage, write the value to the session set
dim name as string = "A"
dim ID as integer = "1"
SESSION ("name ") = Name
SESSION ("ID") = ID
the second web page obtains the value from the session set.
dim name as string = SESSION ("name ")
dim ID as integer = SESSION ("ID")
'gets the number of items in the set of session states.
dim I as integer = session. count
note that in the in-process mode, real serialization and deserialization are not performed, so the objects are stored in the session status as active instances of their respective classes.
in the out-of-process session mode, you need to convert the data type as needed because serialization and deserialization are used.
If you perform a serialization operation on the date value, the date type should be int64.

5. Session lifetime management events
The session lifetime management event has two session_onstart events and session_onend events. You can go to the Global. asax. VB file.
Set them
1. session_onstart event
When a single browser client is connected to the server, the session_onstart event is triggered, marking the start of the session.
Will not trigger this event during browsing, unless the session times out or is abandoned. The session_onstart event is used to set session duration changes.
The best time for traffic, because they are set before accessing any page.
 
Example: The following example shows the session_onstart Event code that is commonly used to count the number of online users:
Sub session_start (byval sender as object, byval e as eventargs)
'When an event occurs, the number of online users is increased by 1.
Application ("usercount") = Application ("usercount") + 1
End sub

2. session_onend event
The session_onend event occurs when the session is abandoned or timed out. It indicates the end of the event. However
Note that only the inproc mode supports this event. You can use the web. config file
The timeout attribute of the <sessionstate> section to specify the time-out period.
Within (in minutes, the default value is 20 minutes.
If you do not refresh the page or request a webpage, the session will be terminated. Session_onend
Parts to clean up.

Example: The following example shows the session_onend Event code that is commonly used to count the number of online users:

Sub session_end (byval sender as object, byval e as eventargs)
Application ("usercount") = Application ("usercount")-1
End sub

For more information about the session status, see: