Asp – Sql server session state problem

AFAIK you can skip the StateConnectionString when storing sessionstate in SQL Server.

I haven't tried it, but it seems to be confirmed here: http://support.microsoft.com/kb/317604

Better in terms of what?

• InProc session is much much faster, has less requirements (serialization), but unusable when you're running your application on several web servers;

• Sql session is much slower, has object serialization requirements, but can be shared between several web servers;

That's the main difference between them that developers should mostly care about.

Cookieless session

You should ask a separate question regarding this, because it's a completely unrelated question to previous one.

If you turn off cookie session ID handling you will be able to see Session ID. But so can you if you check cookies. The number is there.

And Session cookie expiration is set to browser session so it's practically the same in terms of persistence.

Sessions can be hijacked if you know other party's Session ID. It's easier of course if you use cookieless sessions because all you have to do is to change URL...

And there's another thing with copying URLs and sharing/saving (Favourites). I suppose I don't have to explain the problem.

Cookieless sessions are false by default because vast majority of browsers support cookies. You should only turn it on when you know your clients won't have cookies.

Session Timeout

Session timeout is always related to session expiration regardless of session type. But you have to be aware that SQL session state may not obey this setting when you use SQL Express editions because you need SQL Server Agent service to discard expired sessions. You can mitigate this problem by writing you own Windows Service that discards expired sessions.