Question

I am reviewing some web code and I am not exactly sure how ASP.net session state works. Any helps would be gratefully appreciated.

If a User object is saved to the session state during login, and User.FirstName and User.LastName is set. If other web pages retrieve the user object from the session and set the FirstName to something else is that persisted on other web pages? Or, do you need to re-add the user object back to the session once it has been modified? Thanks

Answer 1

Session is persisted on the server, but tracked via the client. I repeat – via the client.

In most cases, sessions are tracked with cookies. So using your example, when User object is saved to Session:

Session["UserInfo"] = new User { FirstName = "Joe", LastName = "Bloggs" };

A cookie will be sent to the client with a unique identifier. This cookie is passed along to all further HTTP requests from this client/browser unless it expires.

If another user comes along (from a different machine) for the first time, Session["UserInfo"] will be null.

An alternative to cookies is “cookieless-session” – where instead of using a cookie to store the session identifer – the identifier is tacked onto the URL.

So the answer is no – other web pages (e.g other clients/machines/browsers) will not have access to this information.

If you want information shared between different clients from the web server, use Cache.

However given the context of the question (User information), it is valid to store this information in the Session, as it is only relevant to a particular user (shouldn’t be shared).

An alternative a lot of people use instead of sticking the User info in the session, is to put it in a generic principle which get’s attached to the Forms Authentication ticket.

Up to you which road you choose.