C# Clear Session

Question #1

I want to know when am I supposed to use:

>Session.Abandon() // When I use this during tracing and after calling it- I find the session still has a value.

And when am I supposed to use :

>Session.Clear()

When should I use each specific method?

---

• In general?
• In my specific case?

I check if session is not equal null in Page Load. If session is equal to null, I wanna to clear session and redirect to the login page?

Should I use something like this:

private void initSession()
{
    Session.Clear();
    Session.Abandon();
    Response.Redirect("LoginPage.aspx");
}

In ASP.NET, when should I use Session.Clear() rather than Session.Abandon()?

> Session.Abandon() destroys the session > and the Session_OnEnd event is > triggered. > > Session.Clear() just removes all > values (content) from the Object. The > session with the same key is still > alive. > > So, if you use Session.Abandon(), you > lose that specific session and the > user will get a new session key. You > could use it for example when the user > logs out. > > Use Session.Clear(), if you want that > the user remaining in the same session > (if you don't want him to relogin for > example) and reset all his session > specific data.

What is the difference between Session.Abandon() and Session.Clear()

> Clear - Removes all keys and values > from the session-state collection. > > Abandon - removes all the objects > stored in a Session. If you do not > call the Abandon method explicitly, > the server removes these objects and > destroys the session when the session > times out. It also raises events like > Session_End. > > Session.Clear can be compared to > removing all books from the shelf, > while Session.Abandon is more like > throwing away the whole shelf. > > ... > > Generally, in most cases you need to > use Session.Clear. You can use > Session.Abandon if you are sure the > user is going to leave your site. > > > So back to the differences: > > - Abandon raises Session_End request. > - Clear removes items immediately, Abandon does not. > - Abandon releases the SessionState object and its items so it can garbage > collected. > - Clear keeps SessionState and resources associated with it.

Session.Clear() or Session.Abandon() ?

> You use Session.Clear() when you don't > want to end the session but rather > just clear all the keys in the session > and reinitialize the session. > > Session.Clear() will not cause the > Session_End eventhandler in your > Global.asax file to execute. > > But on the other hand > Session.Abandon() will remove the > session altogether and will execute > Session_End eventhandler. > > Session.Clear() is like removing books > from the bookshelf > > Session.Abandon() is like throwing the > bookshelf itself.

Question

I check on some sessions if not equal null in the page load. if one of them equal null i wanna to clear all the sessions and redirect to the login page?

Answer

If you want the user to login again, use Session.Abandon.

Found this article on net, very relevant to this topic. So posting here.

ASP.NET Internals - Clearing ASP.NET Session variables

The other big difference is Abandon does not remove items immediately, but when it does then cleanup it does a loop over session items to check for STA COM objects it needs to handle specially. And this can be a problem.

Under high load it's possible for two (or more) requests to make it to the server for the same session (that is two requests with the same session cookie). Their execution will be serialized, but since Abandon doesn't clear out the items synchronously but rather sets a flag it's possible for both requests to run, and both requests to schedule a work item to clear out session "later". Both these work items can then run at the same time, and both are checking the session objects, and both are clearing out the array of objects, and what happens when you have two things iterating over a list and changing it?? Boom! And since this happens in a queueuserworkitem callback and is NOT done in a try/catch (thanks MS), it will bring down your entire app domain. Been there.