对于asp.net中的会话状态模式，InProc或SQL Server哪个更好?

I am developing an ASP.NET website. I want to know which one is better in session state mode: InProc or SQL Server? I need to hear about your experiences on this issue.

我正在开发ASP。网的网站。我想知道在会话状态模式下哪个更好:InProc或SQL Server?我想听听你在这个问题上的经验。

Another question is about cookieless attribute. Is there any security hole in my site if I set it to true? In all the samples I saw in MSDN site, this attribute was set to false.

另一个问题是关于无cookie属性的。如果我设置为true，我的站点是否存在安全漏洞?在我在MSDN站点看到的所有示例中，这个属性被设置为false。

And the last question is about Timeout attribute. Does this attribute effect my sessions lifetime when I set it to InProc mode?

最后一个问题是关于Timeout属性。当我将会话设置为InProc模式时，这个属性是否会影响会话的生命周期?

4 个解决方案

#1

Better in terms of what?

• InProc session is much much faster, has less requirements (serialization), but unusable when you're running your application on several web servers;

  InProc会话要快得多，要求更少(序列化)，但是当您在多个web服务器上运行应用程序时，它就不能使用了;

• Sql session is much slower, has object serialization requirements, but can be shared between several web servers;

  Sql会话要慢得多，有对象序列化需求，但是可以在多个web服务器之间共享;

That's the main difference between them that developers should mostly care about.

这就是开发人员应该关心的主要区别。

Cookieless session

You should ask a separate question regarding this, because it's a completely unrelated question to previous one.

你应该问一个单独的问题，因为这是一个与前一个完全无关的问题。

If you turn off cookie session ID handling you will be able to see Session ID. But so can you if you check cookies. The number is there.

如果您关闭cookie会话ID处理，您将能够看到会话ID。但是如果您检查cookie，您也可以看到。有数量。

And Session cookie expiration is set to browser session so it's practically the same in terms of persistence.

会话cookie过期被设置为浏览器会话，所以在持久性方面几乎是一样的。

Sessions can be hijacked if you know other party's Session ID. It's easier of course if you use cookieless sessions because all you have to do is to change URL...

如果您知道另一方的会话ID，会话可能会被劫持。当然，如果您使用无cookie会话会更容易，因为您只需更改URL…

And there's another thing with copying URLs and sharing/saving (Favourites). I suppose I don't have to explain the problem.

复制url和共享/保存(收藏)还有一件事。我想我没必要解释这个问题。

Cookieless sessions are false by default because vast majority of browsers support cookies. You should only turn it on when you know your clients won't have cookies.

默认情况下，无cookie会话是假的，因为大多数浏览器都支持cookie。只有当你知道你的客户没有饼干时，你才应该打开它。

Session Timeout

Session timeout is always related to session expiration regardless of session type. But you have to be aware that SQL session state may not obey this setting when you use SQL Express editions because you need SQL Server Agent service to discard expired sessions. You can mitigate this problem by writing you own Windows Service that discards expired sessions.

会话超时总是与会话过期相关，而与会话类型无关。但是，您必须知道SQL会话状态在使用SQL Express版本时可能不遵守这个设置，因为您需要SQL Server代理服务来丢弃过期的会话。您可以通过编写自己的Windows服务来缓解这个问题，该服务会丢弃过期的会话。

#2

You can use Session in 3 ways. Each one has advantages and disadvantages

你可以用三种方式使用会话。各有利弊

In-Proc :

In-Proc:

• Inproc session is faster.
• Inproc会话更快。
• You can add objects withouth serialization
• 您可以添加对象，而不需要序列化。
• But limited to one server, if your application will run on more than one server. This wont work for you
• 但是，如果您的应用程序将在多个服务器上运行，那么仅限于一个服务器。这对你不起作用。
• If something happens Application Pool you will lose all you session information
• 如果发生什么事情，应用程序池将丢失所有会话信息

Session State :

会话状态:

• Will run as windows service
• 将作为windows服务运行?
• If your app will run accross multiple server, this will help
• 如果你的应用程序将运行accross多个服务器，这将会有所帮助
• Objects added to Session needs to be serialized
• 添加到会话的对象需要序列化

Sql Server:

Sql服务器:

• Uses sql server, but there are Oracle implementation as well
• 使用sql server，但也有Oracle实现
• Slower than State Server
• 低于国家服务器
• Much more reliable
• 更可靠

Check out this question also : SQLServer vs StateServer for ASP.NET Session State Performance

还可以检查这个问题:SQLServer vs staterver。净会话状态的性能

#3

InProc Session State

InProc会话状态

InProc session mode indicates that session state is stored locally, means that with InProc session state mode is store objects in the AppDomain of the Web application.Because of this the session state is lost when IIS (Internet Information System) restarts.
Generally, the AppDomain is restarted based on several factors like memoryLimit attribute settings in the section of the configuration file, modifiying Global.asax or the Web.config file etc.

InProc会话模式表明会话状态是本地存储的，这意味着在InProc会话状态模式下，在Web应用程序的AppDomain中存储对象。因此，当IIS (Internet Information System)重新启动时，会话状态将丢失。通常，AppDomain是基于一些因素重新启动的，比如配置文件的“修改全局”部分中的memoryLimit属性设置。asax或网络。配置文件等。

We can use StateServer or SqlServer session state mode for overcome these issues and here session state is not stored in the AppDomain of the Web application.

我们可以使用StateServer或SqlServer会话状态模式来解决这些问题，这里会话状态没有存储在Web应用程序的AppDomain中。

OutProc Session State

OutProc会话状态

In OutProc Session ,Sessin State is stored In the StateServer and SqlServer modes not in the AppDomain of the Web application.

在OutProc会话中，Sessin状态存储在StateServer和SqlServer模式中，而不是在Web应用程序的AppDomain中。

StateServer: it uses a stand-alone Microsoft Windows service to store session variable, so this service is independent of IIS, it can run on a separate server. You can use this mode for a load-balancing solution because multiple Web servers can share session variables. Although session variables are not lost if you restart IIS, performance is impacted when you cross process boundaries.

StateServer:它使用一个独立的Microsoft Windows服务来存储会话变量，因此该服务独立于IIS，它可以在单独的服务器上运行。您可以将这种模式用于负载平衡解决方案，因为多个Web服务器可以共享会话变量。虽然如果重新启动IIS，会话变量不会丢失，但是当您跨越进程边界时，性能会受到影响。

SqlServer: SqlServer mode also enables you to utilize a state store that is located out of the IIS process and that can be located on the local computer or a remote server. For persistence of session information, you can use SqlServer mode SqlServer mode is similar to out-of-process mode, except that the session data is maintained in a SQL Server.

SqlServer: SqlServer模式还允许您使用位于IIS进程之外、可以位于本地计算机或远程服务器上的状态存储。对于会话信息的持久性，可以使用SqlServer模式，SqlServer模式类似于进程外模式，但会话数据是在SQL服务器中维护的。

#4

SQL session is better option than inproc session

SQL会话是比inproc会话更好的选择