Serialized In-Process ASP.NET Session State Store
ASP.NET provides out of the box three session state stores:
| Provider | Description |
|---|---|
| InProc |
Session state is stored in the ASP.NET cache. |
| SQLServer |
Session state is stored out-of-process in an SQL Server database. |
| StateServer |
Session state is stored out-of-process in an ASP.NET state service. |
Because with SQLServer and StateServer providers the state must cross the AppDomain boundary it needs to be serialized when stored and deserialized when loaded. Because the state needs to be loaded and stored on each request, it is only available from the PostAcquireRequestState to the ReleaseRequestState events. And, because of serialization and deserialization, all objects stored must be serializable any reference held to one of the session state items won’t be to the same item after being deserialized.
On the other hand, with the InProc provider, the state will never be serialized or deserialized, which means that objects don’t need to be serializable and any reference to an item in the state is always a reference to the item in the state even before the PostAcquireRequestState event and after the ReleaseRequestState event.
In practice, developers use the InProc provider and applications are deployed to production using the SQLServer provider. This usually leads to application errors, like storing non serializable objects in the state, that are only uncovered in production. That’s why I’ve written a serializable in-process session state store. You can find the sources here.