ASP.NET - Storing Classes in Session Variables - How it works (memory)?

I've read that you can store classes directly into a session variable i.e.

Session["var"] = myclass;

My question is how the memory management works. Does it automatic开发者_运维技巧ally serialize this into the session on the client side?

Or does it hold the data for the instance of the class in server memory, and just holds a reference in the session object?

ASP.Net will store your object in a static nested dictionary in memory on the server.
It then sends a cookie to the client with the session ID.

Next time the client sends a request, ASP.Net will retrieve the session associated with that ID from the outer dictionary, then give you the inner dictionary containing the objects in that session.

(This is the way the default session provider works; other providers can serialize objects to SQL Server, or do something else entirely)

You don't store classes in the session but instances of these classes. And yes the default session store is memory. You can use SQL Server as session store as well however. Then some serialization will take place.

The session data is not available on client side.

It depends on how you have sessions set up in ASP.NET. The default is the session resides in the server's memory, and is basically just a dictionary. The user is given a session cookie which is used to identify which of these session dictionaries to grab for a given request (one session dictionary per user)

The object never gets sent to the client because the client only has a cookie, and cookies are too small to hold much of anything, and besides sending an object to the client is likely a security problem.

You can configure ASP.NET to use a database instead of memory to store the session, that is detailed here

The Default Session store is in memory. Which is the easiest to use because the objects dont necessarily need to be serializable.

If you changed the session store to lets say SQL SERVER Database. Then all the objects you store in the session will need to be serializable or else they will throw an exception.

Your Session by default only lasts 20mins. You can change this in the web.config to be as long as you want. But after that time is up, the Garbage collection will remove it from memory.