All geek questions in one place

If HTTP has no status, how does ASP.NET MVC support sessions?

I get regular ASP to complete statefullness using viewstate, but MVC is not trying to perpetuate a bold lie about persistence. So how can it support sessions?

+4
source share
2 answers

By default, it saves a randomly generated number in a cookie and saves it in memory. If the browser says that it does not support cookies, asp.net will add the session key to the URL instead, it will display as http://myurl.com/(S(rpfa4y3c5oe2c555ljanprek))/Controller/Action

+7
source

Used by Session ID to identify the user stored in cookies. Harmonization is possible if you know the identifier of the victim, and if other security measures do not interfere (for example, authentication based on IP addresses).

+1
source

Source: https://habr.com/ru/post/1480255/

More articles:


All Articles