The <sessionState> element configures session-state settings for the current application.
When a new client begins interacting with a Web application, a session ID is issued and associated with all the subsequent requests from the same client while the session is valid. This ID is used to maintain the server-side state that is associated with the client session across requests. The <sessionState> element controls how the ASP.NET application establishes and maintains this association for each client.
This mechanism is very flexible and lets you host session-state information out of process and track state without using cookies, among other things.
You can exceed the maximum size of the URI when you send the session ID in the URI. If the combination of the anonymous identification ticket, forms authentication ticket, session ID, and user data is greater than the maximum permissible URI length, the request will fail with a 400-Bad Request error.
To use StateServer mode
-
On the remote server that will store session-state information, make sure that the ASP.NET state service is running.
The ASP.NET state service is installed with ASP.NET, and by default is located in %windir%\Microsoft.NET\Framework\version\aspnet_state.exe.
-
In the Web.config file for the application, set mode to "StateServer" and stateConnectionString to a value, such as "tcpip=dataserver:42424".
To use SQLServer mode
-
On the computer running SQL Server that will store the session state, run InstallSqlState.sql.
By default, InstallSqlState.sql is in %windir%\Microsoft.NET\Framework\version.
This creates a database named ASPState with new stored procedures and tables named ASPStateTempApplications and ASPStateTempSessions in the TempDB database.
-
In the Web.config file for the application, set mode to "SQLServer" and sqlConnectionString to a value, such as "data source=localhost;Integrated Security=SSPI;".
.gif) Note |
|---|
| You can use Aspnet_regsql.exe to complete these steps. |
For information about accessing and modifying configuration values for the <sessionState> element in application code, see SessionStateSection and System.Web.SessionState.
Default Configuration
The following default <sessionState> element is not explicitly configured in the Machine.config file or in the root Web.config file. However, it is the default configuration that is returned by the application.
<sessionState
mode="InProc"
stateConnectionString="tcpip=127.0.0.1:42424"
stateNetworkTimeout="10"
sqlConnectionString="data source=127.0.0.1;Integrated Security=SSPI"
sqlCommandTimeout="30"
customProvider=""
cookieless="UseCookies"
cookieName="ASP.NET_SessionId"
timeout="20"
allowCustomSqlDatabase="false"
regenerateExpiredSessionId="true"
partitionResolverType=""
useHostingIdentity="true">
<providers>
<clear />
</providers>
</sessionState>