Session in ASP.net can be stored in 3 ways.
- 1. Inproc
2. State Server
The InProc mode of Session State management is the fastest among all of the storage modes available and stores the Session data in the ASP.NET worker process. Performance will be effected if the amount of data stored in the session is large. Basically the session is stored in the memory space of an application domain and is volatile. So if asp.net worker process i.e. aspnet_wp.exe restarts then the session state will be lost.
The Session State here entirely depends on the lifetime of the application domain that it runs on. Note that the Session_End event which is fired internally by the web server is supported only in InProc mode. Note that even if the Session State is set to read only using the EnableSessionState attribute, in the InProc mode one can still modify the session. The Session_OnEnd event is invoked by the runtime environment when we make a call to the Session.Abandon() method or when the user’s session times out. Further, any change made in the settings in the web.config file unloads the application domain and the Session State too.
The StateServer mode uses a stand-alone Microsoft Windows service that is independent of IIS and can run on a separate server. In this case the session state is serialized and stored in memory in a separate process that is managed by the aspnet_state.exe file. This has got some performance drawbacks due to the overhead involved in serialization and de-serialization of objects. The main primary advantage of storing the Session State in a State Server is that it is not in the same process as the ASP.NET and a crash of ASP.NET would in no way destroy the session data. Secondly, this mode of Session State storage enables to share the information across a web garden or a web farm. Rememeber that this mode is slow compared to the InProc mode as it is stored in an external process.
The SQLServer mode of Session State management is a reliable, secure and centralized storage of a session state. In this the Session data is serialized and stored in a database table in the SQL Server database. It can typically be used in the web farms. It has performance bottlenecks as in the State Server mode of Session State management due to the overhead involved in serialization and de-serialization of the objects that are stored and retrieved to and from the Session. SQL Server is more secure than the InProc or the State server modes of Session State storages as the data can be secured easily by configuring the SQL Server security.