பரணி குமார்

Importance
*********

HTTP is stateless, means that the web pages don’t know if the requests are
from the same client and pages are recreated and destroyed every trip to the
server. Therefore, state management is important for web applications.

Methods
*******

All data that needs to be available to the application across different requests
within the same session is called session state or session state data. For
storing such data between requests, there are in general two possibilities:

· Sending the state information back to the client. With the next
request the current state is transmitted to the server again.
· Keeping the necessary data structures on the server. No session
data (except the referencing identifier) is transmitted to the client.

Drawbacks of managing state information in client
**************************************

· Sending the session state data back to the client is generally not
recommended. From a security perspective, the main problem is
that the session state can easily be manipulated on the client side if
it is not protected appropriately.

· In scenarios where session state information must be transmitted
back to the client, it is generally possible to sign all transmitted
session state information in order to prevent changes on the client
side. When the server receives session state information within
requests from the client, it can check the signature in order to verify
that the data was not altered.

· A functional drawback is that the size of the information that can be
stored by round-tripping it to the client side is limited through the
available bandwidth. For session state data that consists of only a
few bytes this does not matter. However, in scenarios with larger
session state data structures, re-transmitting them with each request
becomes impractical.

State management in server
*********************

Keeping the session state strictly on the server is the recommended solution.

· Session state is stored in the server RAM.
· Session state is serialized and written to a persistent storage.
· Storing mechanism for session is irrelevant from a session
management security point of view.
· Ensure that the session state information is sufficiently protected
against illegal access on the server side.

Session IDs
*********

Typically, the process of managing the state of a web-based client is through
the use of session IDs. Session IDs are used by the application to uniquely
identify a client browser, while background (server-side) processes are used
to associate the session ID with the existing state of the user. Session state
management is a key element of Web application design. ASP.NET contains
a session state support service that is flexible and scalable.