What is the difference between a Session and a Cookie?
2012-06-27 14:37
686 查看
Sessions
Sessions are stored per-user in memory(or an alternative Session-State) on the server. Sessions use a cookie(session key) to tie the user to the session. This means no "sensitive" data is stored in the cookie on the users machine.
Sessions are generally used to maintain state when you navigate through a website. However, they can also be used to hold commonly accessed objects. Only if the Session-state is set to InProc, if set to another Session-State mode the object must also serializable.
Cookies
Cookies are stored per-user on the users machine. A cookie is usually just a bit of information. Cookies are usually used for simple user settings colours preferences ect. No sensitive information should ever be stored in a cookie.
You can never fully trust that a cookie has not been tampered with by a user or outside source however if security is a big concern and you must use cookies then you can either encrypt your cookies or set them to only be transmitted over SSL. A user can clear there cookies at any time or not allow cookies altogether so you cannot count on them being there just because I user has visited your site in the past.
sidenote
It is worth mentioning that ASP.NET also supports cookieless state-management
Sessions are stored per-user in memory(or an alternative Session-State) on the server. Sessions use a cookie(session key) to tie the user to the session. This means no "sensitive" data is stored in the cookie on the users machine.
Sessions are generally used to maintain state when you navigate through a website. However, they can also be used to hold commonly accessed objects. Only if the Session-state is set to InProc, if set to another Session-State mode the object must also serializable.
Session["userName"]="EvilBoy";if(Session["userName"]!=null) lblUserName.Text=Session["userName"].ToString();
Cookies
Cookies are stored per-user on the users machine. A cookie is usually just a bit of information. Cookies are usually used for simple user settings colours preferences ect. No sensitive information should ever be stored in a cookie.
You can never fully trust that a cookie has not been tampered with by a user or outside source however if security is a big concern and you must use cookies then you can either encrypt your cookies or set them to only be transmitted over SSL. A user can clear there cookies at any time or not allow cookies altogether so you cannot count on them being there just because I user has visited your site in the past.
//add a username CookieResponse.Cookies["userName"].Value="EvilBoy";Response.Cookies["userName"].Expires=DateTime.Now.AddDays(10);//Can Limit a cookie to a certain DomainResponse.Cookies["domain"].Domain="Stackoverflow.com";//request a username cookieif(Request.Cookies["userName"]!=null) lblUserName.Text=Server.HtmlEncode(Request.Cookies["userName"].Value);
sidenote
It is worth mentioning that ASP.NET also supports cookieless state-management
相关文章推荐
- What exactly is the difference between “pass by reference” in C and in C++?
- What is the difference between max-device-width and max-width for mobile web?
- What is the difference between WM_DESTROY and WM_NCDESTROY?
- [置顶] What is the difference between Category and Class Extension?
- What is the difference between Array.Clone and Array.Copy Method
- What is the difference between database table and database view?
- What is the difference between arguments and parameters?
- What is the difference between authorized_key and known_host file for SSH
- What is the difference between dpkg and aptitude/apt-get?
- What is the difference between JRE,JVM and JDK?
- macro与inline的区别 What is the difference between macro and inline?
- overload与override的区别 What is the difference between overload and override
- What is the difference between /dev/ttyUSB and /dev/ttyACM?
- what is the difference between "isempty"and "isnull"in the qt bool QString::isEmpty () const Retur.
- what is the difference between static and normal variables in c++
- what is the difference between processes and threads
- What is the difference between differed processing mode and interactive mode?
- What is the difference between a thread and a process?
- What is the difference between Views and Materialized Views in Oracle?
- What is the difference between data mining and machine learning?