Click here to Skip to main content
15,311,191 members
Articles / Web Development / ASP.NET
Posted 2 Aug 2004


85 bookmarked

ASP.NET Session Management Internals

Rate me:
Please Sign up or sign in to vote.
3.52/5 (28 votes)
2 Aug 20044 min read
This article goes through the internals of ASP.NET session management.

Sample Image - HttpSessionState.jpg


Every ASP.NET application needs to manage client session information because of stateless nature of HTTP protocol. A question that is often asked in newsgroups, forums, and mailing lists is that, how does ASP.NET Session Management work, and which technique in ASP.NET is the best way to manage session in a web farm or high volume web site with large number of concurrent users? We will begin with a quick overview of ASP.NET session management alternatives, then dive into ASP.NET Session Management internals, and make some recommendations at the end.

ASP.NET Session Management Alternatives:

ASP.NET provides three modes of session state storage controlled by mode attribute of <sessionState> tag in your web application’s Web.config file. Below is a sample of this tag:

    sqlConnectionString="data source=;Trusted_Connection=yes"
    timeout="20" />
mode Specifies where to store the session state.
 OffDisables session state management.
 InProcSession state is stored locally in memory of ASP.NET worker process.
 StateServerSession state is stored outside ASP.NET worker process and is managed by Windows service. Location of this service is specified by stateConnectionString attribute.
 SQLServerSession state is stored outside ASP.NET worker process in SQL Server database. Location of this database is represented by sqlConnectionString attribute.

Now, let’s take a look at session storage internals.

We access Session data through a property named Session. This Session property is exposed by System.Web.HttpContext class and System.Web.UI.Page. (Every ASP.NET page is converted in a class which derives from Page class.) This Session property is an object of HttpSessionState class in System.Web.SessionState namespace as shown above.

HttpSession object has a private member _dict of type SessionDictionary (namespace System.Web.SessionState) as shown below:

private SessionDictionary _dict;

SessionDictionary is an internal class which derives from NameObjectCollectionBase.

The relationship is depicted in a small class diagram:

SessionDictionary relationship

The most important piece of the session state management puzzle is a HttpModule called SessionStateModule. This HttpModule talks to session state providers and hydrates HttpSessionState for each HTTP request. This HttpModule is listed in your machine.config file in <httpModules> section.

I reproduced part of this section from machine.config file from my computer, for reference:

<add name="OutputCache" type="System.Web.Caching.OutputCacheModule"/>
<add name="Session" type="System.Web.SessionState.SessionStateModule"/>

For every HTTP request to your page in your ASP.NET application, an object of type HttpWorkerRequest is created and is served by an instance of HttpApplication class. (For complete discussion of HTTP Pipeline model, check URLs mentioned in References.)

During the processing of this request, InitModules() method of HttpApplication class is called.

Figure 3 below depicts the entire call sequence:

call graph

Inside InitModules(), all the modules listed under <system.web>/<httpModules> section are initialized, i.e., Init method of each of these HttpModules is called, i.e.. Init method of SessionStateModule is called. In the Init method of SessionStateModule, session state settings are read from <system.web>/<sessionState> section of web.config file of your ASP.NET application, and then it calls another method InitModuleFromConfig. The signature of this method is listed below:

private void InitModuleFromConfig(HttpApplication app, 
                                     Config config, bool configInit);

The parameter app represents the instance of HttpApplication class that is being used to serve the HTTP request.

InitModuleFromConfig adds various event handlers for session management related events that are raised from InitInternal() method of HttpApplication.

Table below shows which EventHandlers in SessionStateModule are tied to which events of HttpApplication class.

Table : HttpApplication Events handled  by the SessionStateModule EventHandlers
AcquireRequestStateBeginAcquireState, EndAcquireState

Please note that, at this point, the session state data has not been acquired. There is one more important thing that happens after the above mentioned EventHandlers are tied. Based on attribute values settings of <system.web>/<sessionState> section in your ASP.NET application's config file, the session state provider is tied to SessionStateModule.

All the session state providers implement the interface IStateClientManager.

Table below shows the type of object used to manage state based on value of the mode attribute of sessionStateTag:

Session State Provider based on mode attribute of <System.web>\<sessionState>
modeClass Handling Session State

This session state provider or StateClientManager is stored in a private variable of SessionStateModule.

Once Init() method of SessionStateModule returns control to InitInternal method of HttpApplication, processing continues and AcquireRequestState event is raised.

It is at this point that session state is actually acquired. When this event is raised, the event handler (BeginAcquireState) in SessionStateModule which was tied earlier is called which then calls GetSessionStateItem of SessionStateModule which then asks StateClientManager to get the session state.

In order to judge the performance difference, we will look into each of these StateClientManagers and see how the session data is actually stored and retrieved. For this and more, stay tuned for Part II.



This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Mandeep S Bhatia
Web Developer
United States United States
No Biography provided

Comments and Discussions

GeneralMy vote of 3 Pin
Ivaylo Slavov25-Jan-14 11:39
MemberIvaylo Slavov25-Jan-14 11:39 session storage Pin
wesnur6-Apr-11 2:00
Memberwesnur6-Apr-11 2:00 
Generalnice article Pin
cynix0087-Jan-11 8:17
Membercynix0087-Jan-11 8:17 
Generallogin.aspx Pin
Ajay Kale New27-Sep-10 0:19
MemberAjay Kale New27-Sep-10 0:19 
Generalre session end Pin
Ajay Kale New9-Sep-10 4:15
MemberAjay Kale New9-Sep-10 4:15 
Questionconcurrent access to InProc Sessions Pin
rose7931-Mar-10 1:50
Memberrose7931-Mar-10 1:50 
GeneralMy vote of 1 Pin
amarjeetyadav27-Jun-09 8:28
Memberamarjeetyadav27-Jun-09 8:28 
GeneralProblem with my session variables Pin
maheshvzx13-Mar-08 18:19
Membermaheshvzx13-Mar-08 18:19 
GeneralThanks for Nice Article Pin
Chirag R Darji18-Apr-07 0:55
MemberChirag R Darji18-Apr-07 0:55 
QuestionUnable to find _dict property there??? Pin
Populate12311-Sep-05 21:04
MemberPopulate12311-Sep-05 21:04 
AnswerRe: Unable to find _dict property there??? Pin
MichaelElliott24-Feb-06 9:15
MemberMichaelElliott24-Feb-06 9:15 
GeneralLack of information Pin
Sebastian P.R. Gingter30-Jan-05 20:39
MemberSebastian P.R. Gingter30-Jan-05 20:39 
GeneralRe: Lack of information Pin
LyphTEC2-Feb-05 18:46
MemberLyphTEC2-Feb-05 18:46 
GeneralRe: Lack of information Pin
AbbasHere19-Aug-09 7:51
MemberAbbasHere19-Aug-09 7:51 
GeneralGreat Article Pin
Prasad Khandekar3-Aug-04 20:37
professionalPrasad Khandekar3-Aug-04 20:37 
GeneralGreat Article, needs better formatting Pin
ronnyek3-Aug-04 12:33
Memberronnyek3-Aug-04 12:33 
GeneralRe: Great Article, needs better formatting Pin
Mandeep S Bhatia3-Aug-04 12:47
MemberMandeep S Bhatia3-Aug-04 12:47 
GeneralRe: Great Article, needs better formatting Pin
AbbasHere19-Aug-09 7:52
MemberAbbasHere19-Aug-09 7:52 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.