sessions vs cookies

[lcscne]

Session("appWelcome") = "Welcome to a little patch of heaven."

3 questions: please answer any or all.

Is Session("appWelcome") stored as a cookie on the user's hard drive or in server memory?

If in server memory: why do cookies have to be enabled on the client?

If on the local disk: why don't I have access to these values in global.asax/Application_BeginRequest? - the cookie info is sent to the web server with the request

[Cstick]

Session state values are stored in the server's memory, however references to the session state items is passed to and from the user's browser via cookies. That is why cookies are required.

There is a cookieless method for maintaining session state references and it can be configured in web.config. However, it is recommended that you don't do this if you are dealing with sensitive information since it uses url querystring instead of cookies.

Application state and Session state are two different states and cannot be crossed.

Do a quick search on google for ".Net Session State" and ".Net Application state", that will turn up dozens of articles that will explain each in detail as well as their differences.