Question

My web application is losing session values for some reason, and it happens after an external web page is called. My application is quite big, so any major change would require too much time. My database is Oracle, not Sql Server.

Would be there an alternative way to store value of those session variables? Actually I just need to keep two session variables.

I was thinking to store those values in a Oracle table. Key would be SessionID. I read that SessionID keeps its value even after other session variables are recycled or lost, but I’m not complete sure.

I was planning to put a function on each page, on Page_Load mewthod, checking if session variable is still there. If not, then go to Oracle table and retrieve it.

Something like:

If Session("MyVariable") Is dbNull.Value Then
  Seek it on Oracle table, using SessionID as Key, and assign to variable Var
  Session("MyVariable") = Var
End If

Do you think it would be OK? Can I trust SessionID?

Answer 1

Well, there are 4 session types that come to mind:

(1) In-process Mode

In this mode session state is stored in a current process and when this process terminates then also the data saved in session state will be lost. This mode is set by default in ASP.NET, underneath you can see example of configuring such a state in web.config file:

<configuration> <sessionstate mode="inproc" cookieless="false" timeout="30" sqlconnectionstring="data source=127.0.0.1;user id=user;password=pass" server="127.0.0.1" port="42424" />  

The most important parameters of this session state are the following:

• mode – there can be three values of this parameters – inproc,
  sqlserver, stateserver. Value inproc in our example indicates that
  session state is in in-process mode
• cookieless – boolean value of this parameters indicates if cookies are needed for session state to work
• timeout – indicates a time for how long a session is valid. Each time when user interacts with your application the timeout is set to
  current time plus value of the timeout

The biggest advantage of this mode is performance. There are no transfers of data between processes so it’s significantly faster.

(2) Out-of-process Mode

In this mode session is stored in separate process so other processes can be terminated and session state will be still maintained. This is a sample configuration of session state in web.config for out-of-process mode:

<configuration> <sessionstate mode="stateserver" cookieless="false" timeout="30" sqlconnectionstring="data source=127.0.0.1;user id=user;password=pass" server="127.0.0.1" port="42424" />  

Underneath you can see parameters for session state in out-of-process mode:

• mode – value set for stateserver indicates that it works in out-of-process mode
• service – indicates a server where state service is, in this example it’s a localhost
• port – indicates a port of state service

As I mentioned before the advantage of this mode is that you don’t loose session state with a process but it has a worse performance then in-process mode.

(3) SQL Server Mode

In SQL server mode session state is stored in SQL server. To configure it you have to put the following code in web.config file:

<configuration> <sessionstate mode="sqlserver" cookieless="false" timeout="30" sqlconnectionstring="data source=server_name;user id=user;password=pass" server="127.0.0.1" port="42424" />  

A parameters that are most important in this mode are:

• mode – set to sqlserver value indicates that session state should work in SQL server mode
• sqlconnectionstring – it contains a string with name of the server, user name and password for SQL server

In this mode the biggest advantage is reliability that you won’t loose session state, however the disadvantage is that it’s slower than previous modes.

(4) Cookieless

In this mode cookies in client’s browser are not required to be enabled. This mode works by modifying URL address with id that identifies the session. The configuration is the following:

<configuration> <sessionstate mode="stateserver" cookieless="true" timeout="30" sqlconnectionstring="data source=127.0.0.1;user id=user;password=pass" server="127.0.0.1" port="42424" />  

Parameter that is vital for this mode is “cookieless” – set in our example to true, which means that cookies are not needed to maintain the state. You already know what is the advantage of this solution – it doesn’t require cookies.

Suggestion:

If you are somehow losing the session value, try out (2) Out-of-process Mode or (3) SQL Server Mode. Both modes give you the benefit of giving your sessions a longer and more persistent life span. These are normally used on large production sites were sessions must be kept alive during user’s visit. Only downside as I mentioned earlier is performance. Though this won’t impact your aplication much if it’s a small to medium app.

This won’t get your lost sessions back, but it will help you keep them alive. Hope this helped you out at least a bit.