Session Management in ASP.NET

State management is a process by which the state and information of a page can be maintained over multiple requests. Asp.net provides several techniques for state management.

State Management is basically divided into two parts:

1. Client side state management
2. Server side state management

Client side state management

The state of the page is maintained at the client side. Following are the various techniques for this:

a. ViewState
b. Cookies
c. QueryString

Server side state management

The state of the page is maintained at the server side.Following are the various techniques for this:

a. Application Variables
b. Session Variables
c. Sql Server

I have attached the design page image which is same for every page for the sake of convenience.

ViewState
View State can be used to store state information for a single user. View State is a built in feature in web controls to persist data between page post backs. You can set View State on/off for each control using EnableViewState property.
By default, EnableViewState property will be set to true.


Following is the code for view state page. This example stores the information of the page.A counter c is incremented on every postback and displayed in the textbox on the show button click.

 protected void Page_Load(object sender, EventArgs e)
    {
        int c;
        if (!IsPostBack)
        {
            c = 0;
            ViewState["counter"] = c;
        }
        else
        {
            c = Convert.ToInt32(ViewState["counter"]);
            c = c + 1;
            ViewState["counter"] = c.ToString();
        }
    }
    protected void  Button_show_Click(object sender, EventArgs e)
{
        TextBox_viewstate.Text = ViewState["counter"].ToString();
}

Limitation of viewState

1. Can be used with a single page.
2. Not secure as it store information in hidden field which can be seen in source code.
3. Performance issue with the increase in size of data stored as ViewState.

Cookies

Technique to store data at client side and access it on another page.it is a small textual file stored on client side either in memory or hard disk. 
It is of 2 types:
a. Temporary cookie: Stored as temporary file on client's RAM.
b. Persist Cookie: Stored as a file on hard disk.

Following is the example of cookie.I this example a temporary cookie is created in source cookie page. It stores the values of the textboxes. Cookie is then added to the Response collection of cookies.This is received by Request collection of cookies on cookies1.aspx page accordingly.

Code to be written on source cookie page:

  protected void Button_submit_Click(object sender, EventArgs e)
    {
        HttpCookie ck = new HttpCookie("MyCookies");
        ck.Values.Add("empid", TextBox_eid.Text);
        ck.Values.Add("empname", TextBox_ename.Text);
        Response.Cookies.Add(ck);
        Response.Redirect("cookies1.aspx");
    }

Code to be written on cookies1.aspx page. i.e. page on which you want to show data stored in cookie.

 protected void Page_Load(object sender, EventArgs e)
    {
        HttpCookie c = Request.Cookies["MyCookies"];
        TextBox_eid.Text = c.Values[0].ToString();
        TextBox_ename.Text = c.Values[1].ToString();
    }

Limitation of cookies:

1. It is a small textual file so can store small amount of data.
2. Not secure as stored on client side and can be tempered.
3. In some cases,browser blocks the cookies.


It is the information appended to the URL.Can be viewed on the address bar of the browser.

Follwing is an example of querystring.In this also we store the values of textboxes in querystring and display it in the destination page textboxes.

code for the source querystring page.

 protected void Button_submit_Click(object sender, EventArgs e)
    {
        string empdetail = "querystring1.aspx?";
        empdetail += "&EmpId=" + TextBox_eid.Text + " &EmpName=" + TextBox_ename.Text;
        Response.Redirect(empdetail);
    }

code for the destination querystring page. i.e. where you want to show the value of querystring. In my case querystring1.aspx

 protected void Page_Load(object sender, EventArgs e)
    {
        TextBox_eid.Text = Request.QueryString["EmpId"];
        TextBox_ename.Text = Request.QueryString["EmpName"];

    }

Limitation of QueryString
1. Not secure as it can be read and modified in address bar.
2. Only small amount of data can be transfered.
3. Some browser also limits the length of URL.

Application Variable

Stores data for the application and can be accessed in any page within an application by any user.It will be reset whenever the server closes and restarts.

In this we create a variable in global.asax page.

code in the global.asax page:

 void Application_Start(object sender, EventArgs e) 
    {
      
        Application["counter"] = 0;

    }

code to be written on page load:

 protected void Page_Load(object sender, EventArgs e)
    {
        Label_counter.Text = Convert.ToString(Convert.ToInt32(Application["session"]) + 1);
        Application["counter"] = Convert.ToInt32(Label_counter.Text);
    }

Session Variable

It stores data for each user session and cab be used anywhere in the website.They are not much scalable as each user consumes memory.

Following is the code for source session page. In this also we will store values of textboxes in session and show it on other page textboxes.

 protected void Button_submit_Click(object sender, EventArgs e)
    {
        Session["eid"] = TextBox_eid.Text;
        Session["ename"] = TextBox_ename.Text;
        Response.Redirect("session1.aspx");
    } 

following is the code for session1.aspx page:

 protected void Page_Load(object sender, EventArgs e)
    {
       TextBox_eid.Text = Session["eid"].ToString();
       TextBox_ename.Text = Session["ename"].ToString();
    }