3

Now I'm reading a book and in the book it says:

"Both Session State and Application state are used for storing a small amount of insecure global information that does not change frequently"

Based on that I have five questions:

  1. In MVC4 we can access session by HttpContext.Session, what's the difference between this and HttpContext.Current.Session?

  2. What's application status used for?

  3. What's the practical difference between Session and Application state?

  4. For which user info we cannot store in session but only store in server database?

  5. Many many browser side cookies have been disabled, does that mean cookie are no longer in use when developing web application?

I hope this is not only helpful to me but also will help others who see this

Any suggestion are welcomed!

Andrew Whitaker
  • 124,656
  • 32
  • 289
  • 307
LifeScript
  • 1,116
  • 5
  • 15
  • 24

2 Answers2

2

  1. There is no difference. Use HttpContext.Current.Session when you are not on a view.

  2. For storing application-wide information that applies to all users. There is only one at a time and the values are the same for all users.

  3. Sessions are at a user level. Application is system-wide. If you need to keep information specific to a user, use session. If the value will be the same for all users, use Application.

  4. Not sure what you mean

Andy T
  • 10,223
  • 5
  • 53
  • 95
2
  1. They both point to the same object.
  2. ApplicationState if for sharing data between different Session objects which are tied to a concrete user session
  3. I stated the main difference under the previous point. To elaborate: objects stored in Session are only accesible to requests that are run under that session (they have session cookie or identification string in url). Objects stored in Application, on the other hand, are available everywhere (for instance in global.asax) and are not dependent on current user.
  4. It depends on your paranoia level. I would not store credit card information or social security number or passwords in an unencrypted format in Session. On the other hand I would not store them unencrypted on the database as well. SessionState can, by the way, be configured to reside in database and thus be shared between different machines.
  5. ASP.NET functions better with cookies. There are ways of making it work without cookies, but it will involve a lot of work.
juhan_h
  • 3,965
  • 4
  • 29
  • 35