Session

A session refers to all the connections that a single client might make to a server in the course of viewing any pages associated with a given application. Sessions are specific to both the individual user and the application. As a result, every user of an application has a separate session and has access to a separate set of session variables.

This logical view of a session begins with the first connection to an application by a client and ends after that client's last connection. However, because of the stateless nature of the web, it is not always possible to define a precise point at which a session ends. A session should end when the user finishes using an application. In most cases, however, a web application has no way of knowing if a user has finished or is just lingering over a page.

Therefore, sessions always terminate after a time-out period of inactivity. If the user does not access a page of the application within this time-out period, ColdFusion interprets this as the end of the session and clears any variables associated with that session.

The default time-out for session variables is 20 minutes. You can change the default time-out on the Memory Variables page of the ColdFusion MX Administrator Server tab.

You can also set the time-out period for session variables inside a specific application (thereby overruling the Administrator default setting) by using the  cfapplication tag sessionTimeout attribute. However, you cannot use the cfapplication tag to set a time-out value that is greater than the maximum session time-out value set on the Administrator Memory Variables page.

Your application can also manually end a session, for example, when a user logs out.
 

Session State

You can store values that need to be persisted for the duration of a user's session in session variables. These variables are unique to each user session and can be accessed in any ASP.NET page within an application. You can set and access session information from within an ASP.NET application. For example:

//Assign a value to the myvariable session variable.
Session["myvariable"] = "somevalue";

//Retrieve the value of the myvariable session variable.
string myString;
if (Session["myvariable"] != null)
  myString = Session["myvariable"].tostring();

Session variables are automatically
		  discarded after they are not used for the time-out setting that is specified in
		  the Web.config file. On each request, the time out is reset. The variables are
		  lost when the session is explicitly abandoned in the code.

 When a
		  session is initiated on first request, the server issues a unique session ID to
		  the user. To persist the session ID, store it in an in-memory cookie (which is
		  the default), or embed it within the request URL after the application name. To
		  switch between cookie and cookieless session state, set the value of the cookieless parameter in the Web.config file to true or false.

 In cookieless mode, the server automatically inserts
		  the session ID in the relative URLs only. An absolute URL is not modified, even
		  if it points to the same ASP.NET application, which can cause the loss of
		  session variables.

 ASP.NET supports three modes of session state: 
		  

• InProc: In-Proc mode stores values in the memory of the ASP.NET worker process. Thus, this mode offers the fastest access to these values. However, when the ASP.NET worker process recycles, the state data is lost.
• StateServer: Alternately, StateServer mode uses a stand-alone Microsoft Windows service to store session variables. Because this service is independent of Microsoft Internet Information Server (IIS), it can run on a separate server. You can use this mode for a load-balancing solution because multiple Web servers can share session variables. Although session variables are not lost if you restart IIS, performance is impacted when you cross process boundaries.
• SqlServer: If you are greatly concerned about the persistence of session information, you can use SqlServer mode to leverage Microsoft SQL Server to ensure the highest level of reliability. SqlServer mode is similar to out-of-process mode, except that the session data is maintained in a SQL Server. SqlServer mode also enables you to utilize a state store that is located out of the IIS process and that can be located on the local computer or a remote server.

Note You can use all three modes with in-memory cookie or cookieless session ID persistence.

Session:
Its nothing but defined as a period of time shared between the web application and user. Every user has individual session. Items/Objects can be placed into the Session which would only define these object for that user. Session contains key variables which help to identify the related values. This can be thought of as a hash table. Each user would represent a different key node in the hash identifying unique values. The Session variables will be clear by the application which can clear it, as well as through the timeout property in the web config file. Usually the timeout is 20 minutes by default.
 
Session Variables are stored on the server, can hold any type of data including references, they are similar to global variables in a windows application and use HTTP cookies to store a key with which to locate user's session variables.
 
The collection of session variables is indexed by the name of the variable or by an integer index. Session variables are created by referring to the session variable by name. You do not have to declare a session variable or explicitly add it to the collection.
 
Lets get it cleared from following example:
Session["firstName"] = "Niradhip" //User's first name
Session["lastName"] = "Chakraborty" //User's last name
// Clear the session variable
Session["FirstName"] = null;
//Clear all Session variables
Session.Abandon();
Note:
By default, ASP.NET session state is enabled for all ASP.NET applications.