2

I recall reading a couple of places that folks are discouraging the use of HTTPContext.Current.Session state in ASP .Net web applications.

Can someone explain some of the reasoning behind this recent trend? ARe there solid technical reasons for this?

Thanks, JohnB

JohnB
  • 3,921
  • 8
  • 49
  • 99
  • Its not a recent trend. Using session for anything that you would not put in the user's cookie has always smelled. See Travis J's answer below. Also, session use can be defeated by things like load balancing. – Maess Feb 26 '14 at 23:33
  • possible duplicate of [Is it a good practice to avoid using Session State in ASP.NET MVC? If yes, why and how?](http://stackoverflow.com/questions/5220980/is-it-a-good-practice-to-avoid-using-session-state-in-asp-net-mvc-if-yes-why-a) – Win Feb 27 '14 at 00:07

2 Answers2

0

The reason is "Session swapping". Basically, it is possible for users to end up with other user's sessions. The result of this can be unnoticed or it can result in users viewing confidential information.

I do not have an exact technical reference for this from MSDN, but have seen it happen "in the wild" before. A quick google search produces a lot of results. Here is one example: http://forums.asp.net/t/1519279.aspx

However, it all depends on how you implement your sessions. In the end, sessions are just a version of caching, so best practice would dictate that this cache does not take place in system memory (the default version of this being "InProc"). In order to follow best practice, it would be advised to setup a server specifically for maintaining sessions which was backed by a database.

In the end, it is not the facility of a session, but it is the "InProc" setting, which is advised against.

Travis J
  • 81,153
  • 41
  • 202
  • 273
0

First, MVC is not webforms, it is meant to be stateless.

http://www.wintellect.com/blogs/jprosise/thoughts-on-asp-net-s-new-mvc-framework

Second, MVC is restful in nature http://dotnetslackers.com/articles/aspnet/AnArchitecturalViewOfTheASPNETMVCFramework.aspx and according to stack overflow (lol) sessions are not restful.

Do sessions really violate RESTfulness?

Third, session is old school. You can upgrade your application with some work on your part, improve data safety and responsiveness as well. "Each HTTP request into the application means that your application must make 2 extra network requests to the out-of-proc store — one to load session before the request is processed and another to store the session back after the request is done processing" http://brockallen.com/2012/04/07/think-twice-about-using-session-state/

Community
  • 1
  • 1
Adam Heeg
  • 1,704
  • 1
  • 14
  • 34