Introduction
Web applications work on HTTP protocol and HTTP is a stateless protocol. Every HTTP request is treated as an independent request. The Server does not have knowledge about the variable values, which are being used in the previous request.
The session is a feature in ASP.NET Core that enables us to save/store the user data. Session stores the data in the dictionary on the Server and SessionId is used as a key. The SessionId is stored on the client at cookie. The SessionId cookie is sent with every request. The SessionId cookie is per browser and it cannot be shared between the browsers. There is no timeout specified for the SessionId cookie and they are deleted when the Browser session ends.
At the Server end, the session is retained for a limited time. The default session timeout at the Server is 20 minutes but it is configurable.
Sessions are of two types, namely In-Proc or In-memory and Out-Proc or Distributed session. If our session is in-memory and our application is hosted on a Web-Farm environment, we need to use sticky sessions to tie each session to a specific Server whereas an Out-Proc session does not require sticky sessions and they are the most preferred way to use sessions in our application.
Configuring session
Microsoft.AspNetCore.The session package provides middleware to manage the sessions in ASP.NET Core. To use the session in our Application, we need to add this package as a dependency in the project.json file.
Project.json
{
"version": "1.0.0-*",
"buildOptions": {
"debugType": "portable",
"emitEntryPoint": true
},
"dependencies": {},
"frameworks": {
"netcoreapp1.0": {
"dependencies": {
"Microsoft.NETCore.App": {
"type": "platform",
"version": "1.0.1"
},
"Microsoft.AspNetCore.Mvc": "1.0.1",
"Microsoft.AspNetCore.Server.Kestrel": "1.0.1",
"Microsoft.AspNetCore.Routing": "1.0.1",
"Microsoft.AspNetCore.Session": "1.0.1"
},
"imports": "dnxcore50"
}
}
}
The next step is to configure the session in the Startup class. We need to call the "AddSession" method in the ConfigureServices method of the startup class. The "AddSession" method has one overload method, which accepts various session options such as Idle Timeout, Cookie Name Cookie Domain, etc. If we do not pass the session options, the system will take the default options. Now, we need to call the "UseSession" method in the Configure method of the startup class. This method enables the session for the Application.
Startup. cs
using System;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
namespace WebApplication
{
public class Startup
{
public void Configure(IApplicationBuilder app)
{
app.UseSession();
app.UseMvc();
app.Run(context =>
{
return context.Response.WriteAsync("Hello Readers!");
});
}
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
services.AddSession(options =>
{
options.IdleTimeout = TimeSpan.FromMinutes(30);
});
}
}
}
It is important to call the "UseSession" method before the "UseMvc" method in the Configure method of the startup class. If we call the “UseMvc” method before the “UseSession” method, the system will throw an exception.

How to access the session?
We can use the session from HttpContext, once it is installed and configured. To use the session in the controller class, we need to reference "Microsoft.AspNet.Http" in the controller. There are three methods that enables us to set the session value, which are Set, SetInt32, and SetString. The "Set" method accepts a byte array as an argument. The SetInt32 and SetString methods are the extension methods of Set and they internally cast byte array to int and string respectively. Same as there are three methods that are used to retrieve the value from the session: Get, GetInt32, and GetString. The Get method returns a byte of arrays.



Abbas ZolfaghariPosted Jan 18, 2025, 8:51 PM
Using System.Text.Json;namespace Microsoft.AspNetCore.Http { public static class SessionExtensions { public static void Set<T>(this ISession session, string key, T value) { session.SetString(key, JsonSerializer.Serialize(value)); } public static T? Get<T>(this ISession session, string key) { var value = session.GetString(key); return value == null ? default : JsonSerializer.Deserialize<T>(value); } public static void SetBytes(this ISession session, string key, byte[] value) { session.SetString(key, Convert.ToBase64String(value)); } public static byte[]? GetBytes(this ISession session, string key) { var value = session.GetString(key); return value == null ? default : Convert.FromBase64String(value); } } }
Anshul JainPosted Jun 23, 2021, 7:57 PM
Nice post, Thanks for sharing this. Can we do the same for web api core as well?
vijay sahuPosted Apr 21, 2021, 8:34 AM
Is this session work for users specific only ? means one user one session ?
Pramod GadekarPosted Feb 6, 2020, 2:51 PM
Where all session values are stored at server side in iis or client side in cookies or something else?
Praveen KumarPosted Dec 13, 2019, 1:39 AM
How to show popup dialog box when session is expired in core 2.1
Faisal PathanPosted Sep 5, 2019, 1:27 PM
How can I set session outside controller.
SandyPosted Apr 2, 2019, 2:52 AM
How to clear session in asp.net core because clear() function is not working and there is no funciton like session.Abandon()?
ANIYAN CPosted Feb 20, 2019, 11:18 PM
How do we get current session in .net core api?
Priyanka KalePosted Mar 2, 2018, 2:15 AM
Interesting and definitely something I learn more from this poast!
Kabita RaiPosted Feb 27, 2018, 12:35 AM
How can one determine either the session has expired or not ?
Lucho HrPosted Mar 26, 2017, 3:33 AM
Nice work Jignesh, I have healthy envy, I hope that alkgun day may have your knowledge in ASP.
Upendra Pratap ShahiPosted Feb 27, 2017, 10:54 AM
Nice share sir..Thanks for sharing...