If HTTP is stateless, how does ASP.NET MVC support sessions?

Question

I get that regular ASP finagles statefullness using viewstate, but MVC doesn't try to perpetuate the bold-faced lie of statefulness. So how is it able to maintain sessions?

Ah, so if cookies are disabled, then there is no session. Is it possible to spoof a cookie? — sircodesalot
– sircodesalot, Commented May 11, 2013 at 15:44
@sircodesalot The client can manipulate the cookie as it likes. But if the server does implement sessions correctly, then guessing a valid session id is practically impossible. I don't know how ASP.net does it, but a popular mechanism is generating a random 128 bit value as session ID. — CodesInChaos
– CodesInChaos, Commented May 11, 2013 at 15:49
Maintaining state and session are 2 different things. ASP.NET and ASP.NET MVC can handle SessionState. ASP.NET has ViewState for statefull pages. — Mathias F
– Mathias F, Commented May 11, 2013 at 19:48

Solmead · Accepted Answer · 2013-05-11 15:48:01Z

7

By default it stores a randomly generated number in a cookie and stores that in memory. If the browser says it doesn't support cookies, asp.net will then instead add the session key in the url, it will show up like http://myurl.com/(S(rpfa4y3c5oe2c555ljanprek))/Controller/Action

answered May 11, 2013 at 15:48

Solmead

4,2092 gold badges28 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mark Segal · Accepted Answer · 2013-05-11 15:48:07Z

1

It is using a Session ID to identify a user, stored in Cookies. Spoofing is possible if your know the victim's ID, and if other security measurements won't interfere (e.g IP based authentication).

answered May 11, 2013 at 15:48

Mark Segal

5,6404 gold badges34 silver badges69 bronze badges

4 Comments

ppetrov Over a year ago

you also can use a fake IP in some circumstances

sircodesalot Over a year ago

Wow, I'm familiar with desktop programming, but I'm fairly new to web development. Sounds like web security is fairly complex. Any resources I can turn to to learn more?

marc_s Over a year ago

@sircodesalot: the OWASP Top 10 Project is probably you're best starting point

Mark Segal Over a year ago

@sircodesalot actually, not really. It's all about sanitizing input, just like in every server based programming.

Collectives™ on Stack Overflow

If HTTP is stateless, how does ASP.NET MVC support sessions?

2 Answers 2

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related