title: ASP.NET Masters: What are the advantages / disadvantages of using Session variables?
body: <p>I've done a search on this subject already, and have found the same data over and over-- a review of the three different types of sessions. (InProc, Sql, StateServer) However, my question is of a different nature.</p>
  
  <p>Specifically, what is the advantages/disadvantages of using the built in .NET session in the first place?</p>
  
  <p>Here is why I am asking: A fellow .NET developer has told me to NEVER use the built in Microsoft Session. Not at all. Not even create a custom Session State Provider. His reasoning for this is the following--that if you have the Session turned on in IIS it makes all of your requests happen synchronously. He says that enabling session degrades the performance of a web server.</p>
  
  <p>His solution to this is to create a session yourself-- a class that stores all values you need and is serialized in and out of the database. He advises that you store the unique ID to reference this in a cookie or a querystring variable. In our environment, using a DB to store the sessions is a requirement because all the pages we make are on web farms, and we use Oracle-- so I agree with that part.</p>
  
  <p>Does using the built in Session degrade performance more than a home-built Session? Are there any security concerns with this?</p>
  
  <p>So to sum it all up, what are the advantages/disadvantages?</p>
  
  <p>Thanks to all who answer!</p>