what are the alternatives of SESSION VARIABLES? [duplicate]

Question

What are the limitations of the session variable in developing large web application. Also what are the best alternatives of the session variables.

Please provide me the alternatives of SESSION VARIABLES

Answer 1

To understand the advantages of not using sessions, you have to understand how sessions work.

In the default setup,

• sessions are identified by a cookie set in the user's browser and
• the session data is stored in-memory on the webserver

When the user sends a request to the server, the session cookie is sent along. It contains an identifier which the server uses to locate that particular user's session data.

You can configure ASP.NET to

• use query parameters instead of cookies to store the session identifier
• store the session data in a database (having a central data store for session data is particularly important if you have multiple servers serving your site)

Now for the advantages of disabling session state:

1. ASP.NET makes access to the session data thread-safe by serialising requests. This means that, when session state is enabled, ASP.NET refuses to serve concurrent requests from the same user. This is particularly an issue when the user's browser makes a lot of ajax requests. This problem can be mitigated by marking session state read-only for requests where you don't need to update it.
2. When the request comes in, ASP.NET has to fetch the session data, and it has to write data back when the request ends. This may not be a big issue if session state is stored in-memory, but if data is stored in a central database, this can cause serious performance problems.

Needless to say, these issues are exacerbated by storing large amounts of data for a large number of users.

For more information see

1. ASP.NET Session State Overview
2. Fast, Scalable, and Secure Session State Management for Your Web Applications

(that last article is a bit dated, but still a good read).

Alternatives

• If you can, avoid session state altogether.
• If you absolutely must associate data with the user, use the mechanisms of HTTP and make the browser carry the data in a cookie or perhaps a query parameter (this is partly what the whole REST-movement is about).

Hope this helps.