SessionID Length

[rn5a]

I am working on a database driven application wherein the SessionID
gets populated in a database table column.

After populatating the DB table column with several SessionIDs, I have
noticed that the length of all the SessionIDs is 24 i.e. all the
SessionIDs have 24 alphanumeric characters.

Now what I would like to know is is the length of SessionIDs ALWAYS
GUARANTEED to be 24 in ASP.NET?

 

[Guest]

Howdy,

Yes and no. If you are using standard session state management, standard id
provider is used (System.Web.SessionState.SessionIDManager) which is public
so you can create and access ISessionIDManager interface methods:

public interface ISessionIDManager
{
// Methods
string CreateSessionID(HttpContext context);
string GetSessionID(HttpContext context);
void Initialize();
bool InitializeRequest(HttpContext context, bool
suppressAutoDetectRedirect, out bool supportSessionIDReissue);
void RemoveSessionID(HttpContext context);
void SaveSessionID(HttpContext context, string id, out bool
redirected, out bool cookieAdded);
bool Validate(string id);
}

where the most obvious member to use would be Validate(). Current (ASP.NET
2.0) implementation utilizes the internal class for generating ids
System.Web.SessionState.SessionId which defines fixed session id length 24
for cookie based session, and 26 for cookieless sessions. Have in mind future
implemenations may vary so never assume it'll always be 24. Instead, define a
public constant you can easly change in future in case internal implemenation
changes. I forgot they also defined a constant which holds maximum number of
characters that can be used in session id:
System.Web.SessionState.SessionIDManager.SessionIDMaxLength = 80

You may create NVARCHAR(80) column for session ids

Hope this helps