Inproc and Outproc session state modes

Question

I have basic understanding of session state modes,i have gone through this article on MSDN but not able to understand When to use InProc,StateServer and SqlServer session modes?more specifically confused between when to use State server and when to use sqlserver?

Answer 1

The 3 various modes help spread out your state in different ways to make your application more scalable across a farm and to make it more robust in its own operation.

InProc
InProc is the most basic session management scenario where the the session is stored attached to the process that is actually running it. This means it has the fastest response time because the server doesn't have to go to an alternate source to fetch the data it needs. While it's technically the fastest, it's also the weakest because it can only be used on the server which is running the website. It also is prone to memory dumps. If your site crashes for any reason, the sessions are dumped along with the process. For small, very stable sites, InProc is perfectly acceptable and possibly even ideal. InProc also has the benefit of being able to hold any memory object in session. This can also be problematic if you attempt to hold enormous objects.

StateServer
StateServer refers to the ASP.Net state server service that can reside on any particular machine. It typically operates on port 42424, and can service a single machine or many machines. It is intended to be faster than the SQL server state management methods, but I would argue that the difference in speed is negligible. Perhaps in very large enterprise environments the difference becomes noticeable, but for the web farms I've seen it is not. StateServer requires that any objects in session be Serializable in order to be stored and transferred properly. This means that not just any object can be placed in session, so you have plan ahead when constructing your classes. The state server can be on the machine your website is on or it can be on a machine that is accessible through the 42424 port. This means that session data is decoupled from the IIS process and is therefore "immune" to crashes and hangs. This allows you to have a farm of servers using a common state server, and load balancing becomes simple if the client does not need to be restricted to a specific server. While the state server service is fairly rapid, it operates on a port that many network administrators consider to be simply another "attack vector" for intrusions. Which leads to the SQL state server.

SqlServer SqlServer mode operates much the same as StateServer. Objects must be serialized, the sql server can be local or it can be remote making it less prone to single server crashes in a farm. Network administrators tend to prefer sql servers for state management because they reduce intrusion vectors. Since your website will likely need a sql server to perform data access anyway, this is just piggy backing. Sql server also allows you to visibly inspect what is in the state tables.

My preference typically is for the StateServer. It is very easy to get up and running and you can have a common one that holds state for many environments that are not related (re: dev, qa, etc). It requires no actual maintenance and is very easy to set up. It also does not require licenses to run as sql server does. However, as your need to decentralization and security increases, sql server becomes a much more friendly option. Use InProc for only the most basic sites or sites with limited traffic.