Cookies and Sessions

Question

What is the Difference between Cookies and Session in ASP.net?

Subash · Answer

Thanks Rajeev Punhani

Subash · Answer

Thanks Vinay Singh

Subash · Answer

@ Praveen Kumar Sreeram Thanks for your Beautiful Explantion

Subash · Answer

@ Munesh Sharma Thanks Simple and Easy to understand

Munesh Sharma · Answer

Cookies 1. Cookies can store only "string" datatype 2. They are stored at Client side 3. Cookie is non-secure since stored in text format at client side 4. Cookies may or may not be individual for every client 5. Due to cookies network traffic will increase.Size of cookie is limited to 40 and number of cookies to be used is restricted to 20. 6. Only in few situations we can use cookies because of no security 7. We can disable cookies 8. Since the value is string there is no security 9. We have persistent and non-persistent cookies Session 1. Session can store any type of data because the value is of datatype of "object" 2. These are stored at Server side 3. Session are secure because it is stored in binary format/encrypted form and it gets decrypted at server 4. Session is independent for every client i.e individual for every client 5. There is no limitation on size or number of sessions to be used in an application 6. For all conditions/situations we can use sessions 7. we cannot disable the sessions.Sessions can be used without cookies also(by disabling cookies) 8. The disadvantage of session is that it is a burden/overhead on server 9. Sessions are called as Non-Persistent cookies because its life time can be set manually

Vinay Singh · Answer

Hi check the difference • The basic and main difference between cookie and session is that cookies are stored in the user's browser but sessions can't store in user's browser. This specifies which is best used for. • A cookie can keep all the information in the client's browser until deleted. If a person has a login and password, this can be set as a cookie in their browser so they do not have to re-login to your website every time they visit. You can store almost anything in a browser cookie. • Sessions are not reliant on the user allowing a cookie. They work like a token in the browser which allowing access and passing information while the user has opened his browser. The problem in sessions is when you close the browser the session will automatically lost. So, if you had a site requiring a login, this couldn't be saved as a session but it can be saved as a cookie, and the user has to re-login every time they visit. For detail check the links http://www.allinterview.com/showanswers/74177/what-is-the-difference-between-cookies-and-session.html http://www.codeproject.com/Questions/309565/Difference-between-session-viwestate-and-cookies http://forums.asp.net/t/1527775.aspx?Difference+between+Session+and+cookie

Praveen Sreeram · Answer

Hi Subash, It's a basic question about Web Application. However, it's a very interested topic to discuss. I have seen lot of developers don't understand the basics of how cookies and sessions work. Sessions and Cookies are used for handling State Management. Before discussing about these two, let's see why and what is State Management. All Web resources (web pages) are handled using Http(s) protocol which is a stateless protocol which means, once the request received by the server, it just processes the requests, sends the response to the client (browser) and it just forgets from the where the request has originated from. So, because of this stateless behavior, it is not possible to pass the data from one web page to another web page. So, the solution for is to have State Management. There are two ways of handling State Management. Client Side Server Side Application variables and session variables could be used in Server Side State management Cookies, ViewState (specific to ASP.NET), hidden variables, query strings could be used in Client Side state management. Coming specific to your question. Both Cookies and Sessions could be used to store any data of a given user for that session (till the browser is closed. However, there is an exception for Persistant cookie which could last based on the value that you configure) Differences: Below are the major differences. Sessions: Sessions are stored in Server's RAM and so are secured. You can store any amount of data (depending on your hardware resources of your server. It's not recommended to store huge volumes of course. Cookies: There are two types of cookies In-memory cookies - These are expired as soon as you close the browser Persistant Cookies - There are stored in user's hard disk even if the browser is closed. ex: In facebook / gmail, "Remember me" functionality use this. As these are stored in user's hard disk, these are not secured. There is a limitation for saving data in each cookie. I think it's 4 MB. You need to use them based on the requirement and the guidelines. Hope it is clear. Please let me know if you have any other quetions. Thanks, Prawin

Rajeev Punhani · Answer

Hi Subhash, Bothcookies and session are state management techniques in Asp.net. Cookies store the user data on client side in browser or in a text file. So we have 2 types of cookies persistent and non persistent. If we set the expiration time for a cookie then it is persistent cookie,ie.it will be stored as a text file .Even if we close and open browser it will retain value. Session is a server side state management technique. Session uses cookies tostore and identify session id.In asp.net session is stored in browser as ASP.NET_SessionId.Default timeout for session is 20 min .After this period session expires. We can disable session id to be stored as cookies by adding a value in web.config. "InProc" cookieless= "true" timeout= "7" /> After adding cookieless=true,your session id will be appear in url. If the above solution is helpful then, accept the answer.

Cookies and Sessions

Answers (8)