473,802 Members | 1,960 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Two Session State Related Questions

Hello,
I am currently deploying an ASP .NET based web application via Visual
Studio 2005 (so I am using .NET 2.0 technology). The two questions I have
are with regards to session state in ASP.NET. The first one is how secure is
keeping login information in sessionstate using the inproc model and a cookie
configuration? The second question I have relating to session states is for
an inproc based sessionstate configuration what would be the maximum number
of users that you could have using the system before it becomes unreasonable?
I am aware that there may be better options for sessionstate management than
inproc, but depending on how many people inproc can reasonably support, I
would rather use inproc sessionstate. If someone could answer these
questions, it would be greatly appreciated.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 9 '06 #1
3 1464
maybe this article would give you some pointers..
http://west-wind.com/weblog/posts/1986.aspx.
"James Simpson" wrote:
Hello,
I am currently deploying an ASP .NET based web application via Visual
Studio 2005 (so I am using .NET 2.0 technology). The two questions I have
are with regards to session state in ASP.NET. The first one is how secure is
keeping login information in sessionstate using the inproc model and a cookie
configuration? The second question I have relating to session states is for
an inproc based sessionstate configuration what would be the maximum number
of users that you could have using the system before it becomes unreasonable?
I am aware that there may be better options for sessionstate management than
inproc, but depending on how many people inproc can reasonably support, I
would rather use inproc sessionstate. If someone could answer these
questions, it would be greatly appreciated.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 10 '06 #2
Hello again,
I followed the link you have provided but it has merely shown me reasons
not to use InProc in ASP.NET sessionstates. I am aware that Inproc isn't
practical for many situations, however in the business world this type of
simplicity of Inproc would be required for my web application. Inproc
certainly does have a fair amount of limits, but I need to understand more
about the limits behind Inproc so that I can adjust my solution accordingly.
If someone could please post a site of give me some rough numbers with
regards to the practical limit of concurrent users with InProc sessionstates
and the relative security of using this system. Again, I am aware that there
are far better solutions in most cases, but my web application's situation
isn't like most other cases and really ought to use InProc session states.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 10 '06 #3
James Simpson wrote:
Hello again,
I followed the link you have provided but it has merely shown me reasons
not to use InProc in ASP.NET sessionstates. I am aware that Inproc isn't
practical for many situations, however in the business world this type of
simplicity of Inproc would be required for my web application. Inproc
certainly does have a fair amount of limits, but I need to understand more
about the limits behind Inproc so that I can adjust my solution accordingly.
If someone could please post a site of give me some rough numbers with
regards to the practical limit of concurrent users with InProc sessionstates
and the relative security of using this system. Again, I am aware that there
are far better solutions in most cases, but my web application's situation
isn't like most other cases and really ought to use InProc session states.

Regards,

James Simpson
Straightway Technologies Inc.
Hi James,

Please don't take the following statement the wrong way. You've decided
to use InProc, because you think it meets your needs, so why are you
looking any further?

Okay, slightly more seriously, you aren't going to find somewhere with
any useful numbers. One site running on an old desktop machine with
256M of memory, keeping 2K of information in session will be able to
handle a lot less users than a modern quad Xeon box with Gigs of memory
and only keeping an int in session state.

The only real way to determine what's reasonable is for you to obtain
your production box (or preferably, a test box specced identically);
decide what is acceptable in your (or your users) eyes - i.e. subsecond
response may be required for some projects, in others a wait of tens of
seconds may be deemed acceptable; and either use your system or
simulate the approximate load you anticipate your system will have on
the session. Then ramp up the number of users until response becomes
unacceptable. This really is the only way you'll get the numbers you
want. Anything else will be wild approximations.

Damien

Oct 10 '06 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

27
7133
by: mrbog | last post by:
Tell me if my assertion is wrong here: The only way to prevent session hijacking is to NEVER store authentication information (such as name/password) in the session. Well, to never authenticate a user from information you got from the session. Each secure app on a site must challenge the user for name and password, each and every time the user accesses it (not just once and then store it in the session). If a secure app is multi-page,...
7
7230
by: Billy Jacobs | last post by:
I am having a problem with my session variable being set to Null for no apparent reason. I am declaring it like the following when the user logs in. dim objUserInfo as new clsUserInfo 'Set some properties objUserInfo.UserName = txtUserName.text.trim objUserInfo...
5
3660
by: Phil Grimpo | last post by:
I have a very odd situation here. I have an administration page, where based on a users permissions, a recordset is called from the SQL server which has a list of paths to "Module Menus". Each of these menus are then placed into the page by calling Server.Execute(rs_Modules("ModulePath")). This works fine for up to 15 "menus" After that, the session variables that were set (not including those called by Global.ASA) are no longer set. ...
1
2415
by: Johan Nedin | last post by:
Hello! I have a problem with SQLSession state on my ASP.NET pages. SQLSession state behaves very different from InProcess session state, which I think is very bad. I can understand some of the differences, e.g that every object you store in SQLSession state have to be serializable, but other differences are very unfortunate.
10
3517
by: tshad | last post by:
I have been using the default session state (InProc) and have found that I have been loosing my information after a period of time (normally 20 minutes). Is there anyway to find out how much more time I have on a session? If I do a refresh, does reset the session clock? Do you have have to go to another page to reset the session timeout or will a postback also do it? This is important as we have a few pages that a user
6
1762
by: spacehopper_man | last post by:
I'm considering ditching all use of Session state in favour of Application state. This is because - from what I can work out - it will be more memory efficient for me. I have three questions: 1) When is memory used for Session State freed (or essentially freed)? - if ever...
11
7924
by: Joseph Geretz | last post by:
I've been looking at two approaches for the maintenance of Session state for a Web Service application. One approach uses the old familiar Session object which I've used in the past for Web applications. As far as I can see, the Session approach is non-standard since Web Services are supposed to be agnostic with respect to their clients. It seems that cookies are outside the Web Service standard; therefore, such a Web Service application...
6
2444
by: DNB | last post by:
I would like to know what you guys think is the best way to access data: Asp.Net session vs. Database Queries. In our application we are using asp.net tree view to display hierarchical data and when user clicks on particular node it brings up totally different page with all the asp.net controls dynamically generated. Example: Tree view Control is as follow:
4
2517
by: Cirene | last post by:
In my web.config I added <pages enableSessionState="true">. In each of my pages I also added EnableSessionState="True" to the Page declaration. (I didn't think this was necessary, but...) Any reason why even though I did this I keep getting this error.... Server Error in '/abc' Application.
0
9562
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10536
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10304
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
10285
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
10063
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9114
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
6838
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5622
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
3
2966
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.