Cookies and Sessions

@Praveen Kumar SreeramThanks for your Beautiful Explantion

Hi

check the difference

• The basic and main difference between cookie and session is that cookies are stored in the user's browser but sessions can't store in user's browser. This specifies which is best used for.

• A cookie can keep all the information in the client's browser until deleted. If a person has a login and password, this can be set as a cookie in their browser so they do not have to re-login to your website every time they visit. You can store almost anything in a browser cookie.

• Sessions are not reliant on the user allowing a cookie. They work like a token in the browser which allowing access and passing information while the user has opened his browser. The problem in sessions is when you close the browser the session will automatically lost. So, if you had a site requiring a login, this couldn't be saved as a session but it can be saved as a cookie, and the user has to re-login every time they visit.

For detail check the links

http://www.allinterview.com/showanswers/74177/what-is-the-difference-between-cookies-and-session.html

http://www.codeproject.com/Questions/309565/Difference-between-session-viwestate-and-cookies

http://forums.asp.net/t/1527775.aspx?Difference+between+Session+and+cookie

Hi Subash,

It's a basic question about Web Application. However, it's a very interested topic to discuss. I have seen lot of developers don't understand the basics of how cookies and sessions work.

Sessions and Cookies are used for handling State Management. Before discussing about these two, let's see why and what is State Management.

All Web resources (web pages) are handled using Http(s) protocol which is a stateless protocol which means, once the request received by the server, it just processes the requests, sends the response to the client (browser) and it just forgets from the where the request has originated from. So, because of this stateless behavior, it is not possible to pass the data from one web page to another web page.

So, the solution for is to have State Management. There are two ways of handling State Management.

1. Client Side
2. Server Side

Application variables and session variables could be used in Server Side State management

Cookies, ViewState (specific to ASP.NET), hidden variables, query strings could be used in Client Side state management.

Coming specific to your question. Both Cookies and Sessions could be used to store any data of a given user for that session (till the browser is closed. However, there is an exception for Persistant cookie which could last based on the value that you configure)

Differences: Below are the major differences.

Sessions:

1. There are two types of cookies
1. In-memory cookies - These are expired as soon as you close the browser
2. Persistant Cookies - There are stored in user's hard disk even if the browser is closed. ex: In facebook / gmail, "Remember me" functionality use this.
2. As these are stored in user's hard disk, these are not secured.
3. There is a limitation for saving data in each cookie. I think it's 4 MB.

You need to use them based on the requirement and the guidelines.

Hope it is clear. Please let me know if you have any other quetions.

Thanks,

Prawin

Cookies store the user data on client side in browser or in a text file. So we have 2 types of cookies persistent and non persistent. If we set the expiration time for a cookie then it is persistent cookie,ie.it will be stored as a text file .Even if we close and open browser it will retain value.

Session is a server side state management technique. Session uses cookies tostore and identify session id.In asp.net session is stored in browser as ASP.NET_SessionId.Default timeout for session is 20 min .After this period session expires. We can disable session id to be stored as cookies by adding a value in web.config.

After adding cookieless=true,your session id will be appear in url.