session and cookie management in .net

Session and Cookie Session and Cookie Management in .NetManagement in .Net

Sandeep Kiran ShivaSandeep Kiran ShivaUIN: 00822389UIN: 00822389

State Management State Management OverviewOverview

•New instance of the Web page class is created each time the page is posted to the server.•Http is a stateless protocol!

•ASP.NET options for State Management:

Client Based :•View state•Control state•Hidden fields•Cookies•Query strings

Server Based:•Application state•Session state•Profile Properties

Cookies-IntroductionCookies-Introduction

• A cookie is a small bit of text that accompanies requests and pages as they go between the Web server and browser. The cookie contains information the Web application can read whenever the user visits the site.

•A cookie consists of one or more  name-value pairs  containing bits of information, which may be encrypted for information privacy and data security purposes.

•Uses: Authentication, Session tracking (state maintenance), Storing site preferences,  Shopping cart contents, The identifier for a server-based session, Anything else that can be accomplished through storing textual data.

Write a Cookie:

Response.Cookies["userName"].Value = "patrick"; Response.Cookies["userName"].Expires = DateTime.Now.AddDays(1); >>Here, the values of the Cookies() collection are set directly.

HttpCookie aCookie = new HttpCookie("lastVisit"); aCookie.Value = DateTime.Now.ToString(); aCookie.Expires = DateTime.Now.AddDays(1); Response.Cookies.Add(aCookie);>>Here, the code creates an instance of an object of type HttpCookie

Read a Cookie:

if(Request.Cookies["userName"] != null) Label1.Text = Server.HtmlEncode(Request.Cookies["userName"].Value);

if(Request.Cookies["userName"] != null) { HttpCookie aCookie = Request.Cookies["userName"]; Label1.Text = Server.HtmlEncode(aCookie.Value); }

Delete a Cookie:

HttpCookie aCookie; string cookieName; int limit = Request.Cookies.Count; for (int i=0; i<limit; i++) {

cookieName = Request.Cookies[i].Name; aCookie = new HttpCookie(cookieName); aCookie.Expires = DateTime.Now.AddDays(-1); Response.Cookies.Add(aCookie);

}

Cookie Scope:

HttpCookie appCookie = new HttpCookie("AppCookie"); appCookie.Value = "written " + DateTime.Now.ToString(); appCookie.Expires = DateTime.Now.AddDays(1); appCookie.Path = "/Application1"; Response.Cookies.Add(appCookie);

Drawbacks:•Cookie Hijacking: Cookie theft is the act of intercepting cookies by an

unauthorized party.

This issue can be overcome by securing the communication between the user's computer and the server by employing Transport Layer Security (https protocol) to encrypt the connection and using a secure flag.

•Cross-site Scripting: making the browser itself send cookies to malicious servers that should not receive them. Encrypting cookies before sending them on the network does not help against this attack

A way for preventing such attacks is by using the HttpOnly flag

Sample code:Sample code:public partial class _Default : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { if (Request.Cookies["id"] != null) { string userId = Request.Cookies["id"].Value; Response.Write("User Id value" + userId); } HttpCookie cookie = Request.Cookies["user"]; // for safety, always check for NULL. If cookie doesn't exist, it will be NULL if (cookie != null) { string name = cookie["name"]; string age = cookie["age"]; lblCookieExistance.Text += "Multi-valued Cookie exist<br>"; lblCookieExistance.Text += string.Format("Name : {0}<br>Age : {1}", name, age); } else lblCookieExistance.Text = "Cookie not exist"; }

protected void CreateCookieClicked(object sender, EventArgs e) { Response.Cookies["id"].Value = "10"; Response.Cookies["id"].Expires = DateTime.Now.AddDays(1); }

protected void btnRemoveCookie_Click(object sender, EventArgs e) { Response.Cookies["id"].Expires = DateTime.Now.AddDays(-1); lblMessage.Text = "Cookie deleted. Try opening the same page in another

window of the same browser"; } protected void btnCreateMultiValuedCookie_Click(object sender, EventArgs e) { HttpCookie cookie = new HttpCookie("user"); cookie["name"] = "Foo"; cookie["age"] = "22"; cookie.Expires = DateTime.Now.AddDays(1); Response.Cookies.Add(cookie); lblMessage.Text = "Cookie created“; }}

Demo …..

Sessions- IntroductionSessions- Introduction•ASP.NET session state enables you to store and retrieve values for a user as the user navigates ASP.NET pages in a Web application.

Fig : For every client session data store separately

Advantages Of Sessions:•It helps to maintain user states and data to all over the application.•It can easily be implemented and we can store any kind of object. •Stores every client data separately. •Session is secure and transparent from user.•Session variables allow for customization of a web site.

Disadvantages:•Performance overhead in case of large volume of user, because of session data stored in server memory.•The overuse of Session variables can lead to very unreadable and unmaintainable code.

Session Variables:•used to store data about the current user and his session.

•Storing values in Session Variables:Session["FirstName"] = FNameTB.Text; Session["LastName"] = LNameTB.Text;

•Retrieving values  from Session Variables://Check weather session variable is null or not if (Session["DataSet"] != null) { //Retrieving Dataset from Session

MyDs = (DataSet)Session["DataSet"]; } Else {

//Do Something else }

Session ID:

•Asp.Net use 120 bit identifier to track each session.•When client communicate with server, only session id is transmitted.•When client request for data, ASP.NET looks on to session ID and retrieves corresponding data.

Method Description

Session.Remove(strSessionName); Remove an Item from Session State Collection

Session.RemoveAll() Remove all items from session collection 

Session.Clear()Remove all items from session collection  Note: There is no difference between Clear and RemoveAll. RemoveAll() calls Clear(), internally.

Session.Abandon() Cancels the Current Session

Removing Session From Session Variable :Following are the list of methods that are used to removing the session .

Cookieless Sessions:

•The SessionID() is stored in a non-expiring session cookie in the browser by default. You can specify that session identifiers not be stored in a cookie by setting the cookieless attribute to true in the sessionState section of the Web.config file.

<configuration> <system.web> <sessionState cookieless="true" /> </system.web> </configuration>

•ASP.NET maintains cookieless session state by automatically inserting a unique session ID into the page's URL

http://www.abcdefg.com/s(lit3py55t21z5v55vlm25s55)/orderform.aspx

ReferenceReference

•http://www.codeproject.com/KB/aspnet/ExploringSession.aspx#2

•http://en.wikipedia.org/wiki/HTTP_cookie

•http://msdn.microsoft.com/en-us/library/ms178582.aspx

Thank You!Thank You!