lost session state in ASP.NET

Question

I'm a beginner in ASP.NET and just a question on session state. I was reading a textbook which says:

the session state will be lost if the user closes and restarts the browser and the session actually remains in memory on the web server, because ASP.NET has no idea that the client has closed the browser or changed windows. The session will linger in memory, remaining inaccessible , until it eventually expires

I don't quite understand what does "remaining inaccessible" mean, because a cookie called "ASP.NET_SessionId" will be created for the first time when the session collection is used on client's machine, so even when the users close and then restart their browsers and access the page again, so the cookie contains session id will still get sent to the server, if the session still remains in memory on the web server, why it is inaccessible?

Answer 1

ASP.NET_SessionId cookie is created as "session cookie" (not "persistent" one - How do I create a persistent vs a non-persistent cookie? ) and when browser closes completely (rarely happens now days) browser will drop all "session" cookies. Since value of the cookie is cryptographically secure random number there is no practical way to reconstruct the value of the cookie and hence retrieve value of old session from the server. Data associated with the value of the cookie will sit in server's memory (or SQL if you use SQL session state) but there will be no requests that can ask for it. Eventually the data will be cleaned when server side expiration happen (or server IIS process shuts down in case of in-memory session state).

Note that most modern browsers don't actually "close session" when you close all instances so you rarely see such case in practice. You can always "clear all cookies" to see it happening.