HttpSessionState Class


The .NET API Reference documentation has a new home. Visit the .NET API Browser on to see the new experience.

Provides access to session-state values as well as session-level settings and lifetime management methods.

Namespace:   System.Web.SessionState
Assembly:  System.Web (in System.Web.dll)


public ref class HttpSessionState sealed : ICollection, IEnumerable


Gets or sets the character-set identifier for the current session.


Gets a reference to the current session-state object.


Gets a value that indicates whether the application is configured for cookieless sessions.


Gets the number of items in the session-state collection.


Gets a value indicating whether the session ID is embedded in the URL or stored in an HTTP cookie.


Gets a value indicating whether the session was created with the current request.


Gets a value indicating whether the session is read-only.


Gets a value indicating whether access to the collection of session-state values is synchronized (thread safe).


Gets or sets a session value by numerical index.


Gets or sets a session value by name.


Gets a collection of the keys for all values stored in the session-state collection.


Gets or sets the locale identifier (LCID) of the current session.


Gets the current session-state mode.


Gets the unique identifier for the session.


Gets a collection of objects declared by <object Runat="Server" Scope="Session"/> tags within the ASP.NET application file Global.asax.


Gets an object that can be used to synchronize access to the collection of session-state values.


Gets and sets the amount of time, in minutes, allowed between requests before the session-state provider terminates the session.


Cancels the current session.

System_CAPS_pubmethodAdd(String^, Object^)

Adds a new item to the session-state collection.


Removes all keys and values from the session-state collection.

System_CAPS_pubmethodCopyTo(Array^, Int32)

Copies the collection of session-state values to a one-dimensional array, starting at the specified index in the array.


Determines whether the specified object is equal to the current object.(Inherited from Object.)


Returns an enumerator that can be used to read all the session-state variable names in the current session.


Serves as the default hash function. (Inherited from Object.)


Gets the Type of the current instance.(Inherited from Object.)


Deletes an item from the session-state collection.


Removes all keys and values from the session-state collection.


Deletes an item at a specified index from the session-state collection.


Returns a string that represents the current object.(Inherited from Object.)


Overloaded. Enables parallelization of a query.(Defined by ParallelEnumerable.)


Overloaded. Converts an IEnumerable to an IQueryable.(Defined by Queryable.)


Casts the elements of an IEnumerable to the specified type.(Defined by Enumerable.)


Filters the elements of an IEnumerable based on a specified type.(Defined by Enumerable.)

ASP.NET provides session-state management to enable you to store information associated with a unique browser session across multiple requests. You can store a collection of values referenced by a key name or by numerical index. Access to session values and functionality is available using the HttpSessionState class, which is accessible through the Session property of the current HttpContext, or the Session property of the Page.

Session data is associated with a specific browser session using a unique identifier. By default, this identifier is stored in a non-expiring session cookie in the browser, but you can also configure your application to store the session identifier in the URL by setting the cookieless attribute to true or UseUri in the element of your application configuration. You can have ASP.NET determine whether cookies are supported by the browser by specifying a value of UseDeviceProfile for the cookieless attribute. You can also have ASP.NET determine whether cookies are enabled for the browser by specifying a value of AutoDetect for the cookieless attribute. If cookies are supported when UseDeviceProfile is specified, or enabled when AutoDetect is specified, then the session identifier will be stored in a cookie; otherwise the session identifier will be stored in the URL.

Sessions are started during the first request and session values will persist as long as a new request is made by the browser before the number of minutes specified in the Timeout property pass. When a new session begins, the session Start event is raised. You can use this event to perform any additional work at the start of a session, such as setting default session values. When a session times out, the Abandon method is called, or the ASP.NET application is shut down, the session End event is raised. You can use this event to perform any necessary cleanup. The End event is raised only when the session state mode is set to InProc.

To improve performance, sessions that use cookies do not allocate session storage until data is actually stored in the Session object. For more information, see the SessionID property.

Session state does not persist across ASP.NET application boundaries. If a browser navigates to another application, the session information is not available to the new application.

Session values are stored in memory on the Web server, by default. You can also store session values in a SQL Server database, an ASP.NET state server, or a custom server. This enables you to preserve session values in cases where the ASP.NET or IIS process or the ASP.NET application restarts and to make session values available across all the servers in a Web farm. This behavior is configured by setting the mode attribute to a valid SessionStateMode value in the element of your application configuration. For more information, see Session-State Modes.

Alternatives to session state include application state (see the Application property) and the ASP.NET cache (see the System.Web.Caching namespace), which store variables that can be accessed by all users of an ASP.NET application; the ASP.NET profile (see the System.Web.Profile namespace), which persists user values in a data store without expiring them using a time-out; ASP.NET System.Web.UI.WebControls, which persist control values in the ViewState; Cookies; the QueryString property; and fields on an HTML form that are available from an HTTP POST using the Form collection. For more details on the differences between session state and other state-management alternatives, see ASP.NET State Management Recommendations.

The following code example sets and retrieves values from session state.

System_CAPS_security Security Note

This example has a text box that accepts user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.

No code example is currently available or this language may not be supported.

.NET Framework
Available since 1.1

Any public static ( Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Return to top