473,473 Members | 1,888 Online
Bytes | Software Development & Data Engineering Community
Create Post

Home Posts Topics Members FAQ

Two Session State Related Questions

Hello,
I am currently deploying an ASP .NET based web application via Visual
Studio 2005 (so I am using .NET 2.0 technology). The two questions I have
are with regards to session state in ASP.NET. The first one is how secure is
keeping login information in sessionstate using the inproc model and a cookie
configuration? The second question I have relating to session states is for
an inproc based sessionstate configuration what would be the maximum number
of users that you could have using the system before it becomes unreasonable?
I am aware that there may be better options for sessionstate management than
inproc, but depending on how many people inproc can reasonably support, I
would rather use inproc sessionstate. If someone could answer these
questions, it would be greatly appreciated.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 9 '06 #1
3 1444
maybe this article would give you some pointers..
http://west-wind.com/weblog/posts/1986.aspx.
"James Simpson" wrote:
Hello,
I am currently deploying an ASP .NET based web application via Visual
Studio 2005 (so I am using .NET 2.0 technology). The two questions I have
are with regards to session state in ASP.NET. The first one is how secure is
keeping login information in sessionstate using the inproc model and a cookie
configuration? The second question I have relating to session states is for
an inproc based sessionstate configuration what would be the maximum number
of users that you could have using the system before it becomes unreasonable?
I am aware that there may be better options for sessionstate management than
inproc, but depending on how many people inproc can reasonably support, I
would rather use inproc sessionstate. If someone could answer these
questions, it would be greatly appreciated.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 10 '06 #2
Hello again,
I followed the link you have provided but it has merely shown me reasons
not to use InProc in ASP.NET sessionstates. I am aware that Inproc isn't
practical for many situations, however in the business world this type of
simplicity of Inproc would be required for my web application. Inproc
certainly does have a fair amount of limits, but I need to understand more
about the limits behind Inproc so that I can adjust my solution accordingly.
If someone could please post a site of give me some rough numbers with
regards to the practical limit of concurrent users with InProc sessionstates
and the relative security of using this system. Again, I am aware that there
are far better solutions in most cases, but my web application's situation
isn't like most other cases and really ought to use InProc session states.

Regards,

James Simpson
Straightway Technologies Inc.
Oct 10 '06 #3
James Simpson wrote:
Hello again,
I followed the link you have provided but it has merely shown me reasons
not to use InProc in ASP.NET sessionstates. I am aware that Inproc isn't
practical for many situations, however in the business world this type of
simplicity of Inproc would be required for my web application. Inproc
certainly does have a fair amount of limits, but I need to understand more
about the limits behind Inproc so that I can adjust my solution accordingly.
If someone could please post a site of give me some rough numbers with
regards to the practical limit of concurrent users with InProc sessionstates
and the relative security of using this system. Again, I am aware that there
are far better solutions in most cases, but my web application's situation
isn't like most other cases and really ought to use InProc session states.

Regards,

James Simpson
Straightway Technologies Inc.
Hi James,

Please don't take the following statement the wrong way. You've decided
to use InProc, because you think it meets your needs, so why are you
looking any further?

Okay, slightly more seriously, you aren't going to find somewhere with
any useful numbers. One site running on an old desktop machine with
256M of memory, keeping 2K of information in session will be able to
handle a lot less users than a modern quad Xeon box with Gigs of memory
and only keeping an int in session state.

The only real way to determine what's reasonable is for you to obtain
your production box (or preferably, a test box specced identically);
decide what is acceptable in your (or your users) eyes - i.e. subsecond
response may be required for some projects, in others a wait of tens of
seconds may be deemed acceptable; and either use your system or
simulate the approximate load you anticipate your system will have on
the session. Then ramp up the number of users until response becomes
unacceptable. This really is the only way you'll get the numbers you
want. Anything else will be wild approximations.

Damien

Oct 10 '06 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

27
by: mrbog | last post by:
Tell me if my assertion is wrong here: The only way to prevent session hijacking is to NEVER store authentication information (such as name/password) in the session. Well, to never authenticate...
7
by: Billy Jacobs | last post by:
I am having a problem with my session variable being set to Null for no apparent reason. I am declaring it like the following when the user logs in. dim objUserInfo as new clsUserInfo 'Set...
5
by: Phil Grimpo | last post by:
I have a very odd situation here. I have an administration page, where based on a users permissions, a recordset is called from the SQL server which has a list of paths to "Module Menus". Each of...
1
by: Johan Nedin | last post by:
Hello! I have a problem with SQLSession state on my ASP.NET pages. SQLSession state behaves very different from InProcess session state, which I think is very bad. I can understand some of...
10
by: tshad | last post by:
I have been using the default session state (InProc) and have found that I have been loosing my information after a period of time (normally 20 minutes). Is there anyway to find out how much...
6
by: spacehopper_man | last post by:
I'm considering ditching all use of Session state in favour of Application state. This is because - from what I can work out - it will be more memory efficient for me. I have three questions:...
11
by: Joseph Geretz | last post by:
I've been looking at two approaches for the maintenance of Session state for a Web Service application. One approach uses the old familiar Session object which I've used in the past for Web...
6
by: DNB | last post by:
I would like to know what you guys think is the best way to access data: Asp.Net session vs. Database Queries. In our application we are using asp.net tree view to display hierarchical data and...
4
by: Cirene | last post by:
In my web.config I added <pages enableSessionState="true">. In each of my pages I also added EnableSessionState="True" to the Page declaration. (I didn't think this was necessary, but...) ...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
0
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...
0
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and...
0
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The...
0
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
0
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated ...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.