Reviewing State Management in ASP.NET

I plan to take a look at the security enhencements of the state management in ASP.NET 2.0. Let me first review the state management in ASP.NET 1.x.

ASP.NET supports the following techniques for storing state info at the client side:

• Query strings
• Cookies
• Hidden fields
• View state

Query strings:

• Require no postback operation
• Most browsers limit the length of data that can be included in a query string
• No security
• No option for persistence
• No support for storing structured values
• Access query strings using HttpRequest.QueryString[''KeyName"]

Cookies:

• State can be persisted on user's machine
• Require no postback
• Some users disable cookies in their browsers
• Size restriction by browser (approx. 4 KB - 8 KB)
• No support for storing structured values
• No security
• HttpRequest.Cookies and HttpResponse.Cookies

Hidden fields:

• Can be used for pages that post to themself or to other pages
• Increases HTML size
• No support for storing structured values
• No option for persistence
• No security

View state:

• Support for structure values
• Easy configuration options for security
• Increases HTML size
• Works only when a page posts back to itself
• No option for persistence
• ASP.NET retrieves values for postback controls from the HTTP request while values for nonpostback controls from the hidden field _VIEWSTATE
• Page.ViewState
• You can disable the view state using the EnableViewState property at the level of a control, a page, an app, and the machine
• EnableViewStateMac is enable by default

ASP.NET supports server-side state management at two levels:

• Session state
• Application state

Session state:

• Page.Session
• Passing SessionID is with nonpersistent cookies by default

Application state:

• The application state is stored in memory
• Page.Application
• Modify the contents of the application state using a pair of Applicatin.Lock() and Application.Unlock()

Notes were taken from the book MCAD Developing and Implementing Web Applications with Microsoft Visual C# .NET and Microsoft Visual Studio .NET Exam Cram 2 (Exam Cram 70-315)by Amit Kalani and Priti Kalani.