SessionStateSection Class
Configures the session state for a Web application.
Syntax
class SessionStateSection : ConfigurationSectionWithCollection
Methods
The following table lists the methods exposed by the SessionStateSection class.
| Name | Description |
|---|---|
| Add | (Inherited from ConfigurationSectionWithCollection.) |
| Clear | (Inherited from ConfigurationSectionWithCollection.) |
| Get | (Inherited from ConfigurationSectionWithCollection.) |
| GetAllowDefinition | (Inherited from ConfigurationSection.) |
| GetAllowLocation | (Inherited from ConfigurationSection.) |
| Remove | (Inherited from ConfigurationSectionWithCollection.) |
| RevertToParent | (Inherited from ConfigurationSection.) |
| SetAllowDefinition | (Inherited from ConfigurationSection.) |
| SetAllowLocation | (Inherited from ConfigurationSection.) |
Properties
The following table lists the properties exposed by the SessionStateSection class.
| Name | Description |
|---|---|
AllowCustomSqlDatabase |
A read/write boolean value. true if the user is allowed to specify the initial catalog value in the SqlConnectionString property; otherwise, false. The default is false. |
Cookieless |
A read/write sint32 value that configures how cookies are used to identify client sessions. The possible values are listed later in the Remarks section. Note: There are two ways that session state can store the unique ID that associates the client with a server session: by storing an HTTP cookie on the client or by encoding the session ID in the URL. Storing the session ID in the cookie is more secure, but it requires the client browser to support cookies. For applications that allow clients that do not support cookies, such as a variety of mobile devices, the session ID may be stored in the URL. The URL option has several drawbacks. It requires that the links on the site be relative and that the page be redirected at the beginning of the session with new query-string values. It also exposes the session ID in the query string, where it can be used in a security attack. You should use the cookieless mode only if you need to support clients that lack cookie support. |
CookieName |
A read/write string value that specifies the name of the HTTP cookie to use for session identification. The default is "ASP.NET_SessionId". |
CustomProvider |
A read/write string value that specifies the name of a custom provider from the Providers property that is used when the Mode property is set to Custom. |
Location |
(Inherited from ConfigurationSection.) A key property. |
Mode |
A read/write sint32 value that specifies where to store the session state. The possible values are listed later in the Remarks section. Note: The Mode property is not required and can be inherited from a higher level in the configuration hierarchy or from the default value. However, the configuration handler will always write out the mode based on the current inherited value for the section. |
PartitionResolverType |
A read/write string value that contains the fully qualified name of the resolver type that partitions session-state data across multiple backend nodes when the Mode property is set to SQLServer or StateServer. Note: If this property is specified, the SqlConnectionString and StateConnectionString properties are ignored. The connection string returned by PartitionResolverType will be used on every request to connect to the appropriate server location for the remainder of the request. If the connection string is not valid, ASP.NET will throw the same exception that is thrown when the configured connection string to the server is not valid. |
Path |
(Inherited from ConfigurationSection.) A key property. |
Providers |
A ProviderSettings value that contains the name and type of providers that perform session-state-related services. |
RegenerateExpiredSessionId |
A read/write boolean value. true if the session ID is regenerated when an expired session ID is specified by the client; otherwise, false. The default is false. Note: By default, only cookieless URLs are reissued when this property is enabled. |
SectionInformation |
(Inherited from ConfigurationSection.) |
SessionIDManagerType |
A read/write string value that specifies the fully qualified type of the session ID manager. |
SqlCommandTimeout |
A read/write datetime value that specifies the time-out for SQL commands that use the SQL Server session-state mode. The default is 30 seconds. |
SqlConnectionString |
A read/write string value that contains the connection string to a SQL Server. The default is "data source=localhost;Integrated Security=SSPI". This property is required when the Mode property is set to SQLServer. |
StateConnectionString |
A read/write string value that specifies the server name and port when the session state is stored remotely. The default is "tcpip=loopback:42424". This property is required when the Mode property is set to StateServer. Note: Make sure the ASP.NET state service is running on the remote server that stores the session-state information. This service is installed with ASP.NET and is located by default at [drive:]\WINDOWS\Microsoft.NET\Framework\VersionNumber\aspnet_state.exe. By default, this service is configured for manual start. You must change the start behavior to Automatic. |
StateNetworkTimeout |
A read/write datetime value that specifies the time, in seconds, that the network connection between the Web server and the state server can remain idle before the session is abandoned. This property is required when the Mode property is set to StateServer. The default is 10 seconds. |
Timeout |
A read/write datetime value that specifies the time, in minutes, after which the session will expire due to inactivity. The default is 20 minutes. Note: You cannot set the Timeout property to a value greater than 525,601 minutes (1 year). |
UseHostingIdentity |
A read/write boolean value. true if Windows authentication and the host process identity (either ASP.NET or a Windows Service identity) are enabled for remote connections; false if the session state uses client impersonation when it is available. The default is true. Note: This setting simplifies the management of Integrated Windows authentication by granting database access only to the ASP.NET worker process or application identity and not to the entire domain or a set of domain users. |
Subclasses
This class contains no subclasses.
Remarks
When a new client begins interacting with a Web application, a session ID is issued and associated with all the subsequent requests from the same client during the time the session is valid. This ID is used to maintain server-side state associated with the client session across requests. The SessionStateSection class controls how the ASP.NET application establishes and maintains this association on behalf of each client.
The following table lists the possible values for the Cookieless property. The default is 1 (UseCookies).
| Value | Keyword | Description |
|---|---|---|
| 0 | UseUri |
The session ID is embedded as a query string in the Uniform Resource Identifier (URI) request, and the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary. Note: When you use the UseUri mode, you should set the RegenerateExpiredSessionId property to true. This allows a Web server to expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content. You should also consider changing the Timeout property to less than the 20-minute default. |
| 1 | UseCookies |
The session ID is stored in an HTTP cookie on the client for the duration of a user's connection to a Web site. Cookies are passed in the HTTP headers of all requests between a client and Web server and are more efficient in tracking session state because they do not require redirection. Additionally, they retain state if a user leaves a site to visit another and then returns to the original site. Note: Consider changing the Timeout property to less than the 20-minute default so that a potential attacker has less time to capture a cookie and gain access to Web site content. |
| 2 | AutoDetect |
The session ID is stored in an HTTP cookie on the client only after a handshake with the browser verifies that a cookie may be stored. Note: When you use the AutoDetect mode, you should set the RegenerateExpiredSessionId property to true. This allows a Web server to expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content. You should also consider changing the Timeout property to less than the 20-minute default. |
| 3 | UseDeviceProfile |
The session ID is stored in an HTTP cookie on the client if the client device profile supports cookies; otherwise, no cookies are used. If the device profile supports cookies, they will be used even if the user has disabled cookie support. Use this setting to ensure that cookieless IDs will be used only with clients that require them (for example, mobile browsers). Note: When you use the UseDeviceProfile mode, you should set the RegenerateExpiredSessionId property to true. This allows a Web server to expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content. You should also consider changing the Timeout property to less than the 20-minute default. |
The following table lists the possible values for the Mode property. The default is 1 (InProc).
| Value | Keyword | Description |
|---|---|---|
| 0 | Off |
Session state is disabled. |
| 1 | InProc |
Session state is stored for an ASP.NET application in the worker process where the application runs. In-process session state is the fastest built-in state storage mode. However, as you store more data in a session, you consume more Web server memory, which can slow performance. In-process session-state data is lost if the worker process recycles. If your ASP.NET applications need to preserve session-state data, and speed of data access is not a primary concern, consider using an out-of-process session-state mode for storing the data. In-process session state cannot be used in a Web farm without a session ID affinity scheme that guarantees that all requests with a given session ID will be directed to the same Web server. Note: The ASP.NET state service (Aspnet_state.exe) must be running for in-process session state to function. This service is installed with ASP.NET and is located by default at [drive:]\WINDOWS\Microsoft.NET\Framework\VersionNumber\aspnet_state.exe. By default, this service is configured for manual start. You must change the start behavior to Automatic. |
| 2 | StateServer |
Session state uses the out-of-process ASP.NET state service to store state information. The advantage of this configuration is that session state is preserved when the application's worker process recycles. If you use this setting, you must specify a connection string in the StateConnectionString property. |
| 3 | SQLServer |
Session state uses an out-of-process SQL Server database to store state information. The advantage of this configuration is that session state is preserved when the application's worker process recycles, or if either the ASP.NET state service or the Web server goes down. If you use this setting, you must specify a connection string in the SqlConnectionString property. Note: To use the SQLServer session-state mode, you must run the InstallSqlState.sql SQL script (which is installed in [drive:]\WINDOWS\Microsoft.NET\Framework\VersionNumber as part of the default .NET Framework installation) on the computer running SQL Server that will store the session state. This creates a database called ASPState with new stored procedures and creates new ASPStateTempApplications and ASPStateTempSessions tables in the TempDB database. |
| 4 | Custom |
Session state uses a custom data store to store session-state information. If you use this setting, you must specify the name of the custom provider in the CustomProvider property. |
Inheritance Hierarchy
ConfigurationSectionWithCollection
SessionStateSection
Requirements
| Type | Description |
|---|---|
| Client | - IIS 7.0 on Windows Vista - IIS 7.5 on Windows 7 - IIS 8.0 on Windows 8 - IIS 10.0 on Windows 10 |
| Server | - IIS 7.0 on Windows Server 2008 - IIS 7.5 on Windows Server 2008 R2 - IIS 8.0 on Windows Server 2012 - IIS 8.5 on Windows Server 2012 R2 - IIS 10.0 on Windows Server 2016 |
| Product | - IIS 7.0, IIS 7.5, IIS 8.0, IIS 8.5, IIS 10.0 |
| MOF file | WebAdministration.mof |
See Also
System.Web.Configuration.SystemWebSectionGroup.SessionState
System.Web.SessionState.SessionStateMode
ConfigurationSectionWithCollection Class
ProviderSettings Class
Fast, Scalable, and Secure Session State Management for Your Web Applications
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for