Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>A <a href="https://en.wikipedia.org/wiki/Session_(computer_science)#Server_side_web_sessions" rel="nofollow noreferrer">Session</a> is used by websites to store <a href="https://en.wikipedia.org/wiki/State_(computer_science)" rel="nofollow noreferrer">application state</a> for visitors across multiple page loads.</p> <h3>Cookie Sessions</h3> <ul> <li>Store their data on the client/user end</li> <li>Work smoothly when you have a cluster of web servers</li> <li>Browsers typically limit cookies to a maximum size of around 4 kilobytes per domain, so limited session data size</li> <li>Cookies can be set to a long lifespan, which means that data stored in a session cookie could be stored for months if not years (Users can clear cookies though)</li> <li>Must be set with HttpOnly and Secure flags, otherwise can be easily stolen via XSS</li> </ul> <h3>Database Sessions</h3> <ul> <li>Store their data server side</li> <li>One of your web servers handles the first request, other web servers in your cluster will not have the stored information unless centrally storing user session data</li> <li>Clients do not have access to the information you store about them and therefore better for sensitive data.</li> <li>Data doesn't have to travel from client to server on each request (clients just need to send an ID so the server can load the data)</li> <li>Can store more data, since stored on server instead of in a cookie</li> </ul> <h3>Cookie Sessions vs Database Sessions</h3> <pre> | Feature | Cookie Sessions | Database Sessions | |-------------------------------|-----------------|-------------------| | Works without database | Yes | No | | Can store sensitive user data | No* | Yes | </pre> <p>* Can store pointers referencing sensitive user data on the server, just not the sensitive data itself.</p> <p>Both Cookie Sessions and Database Sessions work the same way, the only difference is where the data is stored. <a href="https://docs.djangoproject.com/en/latest/topics/http/sessions/#configuring-the-session-engine" rel="nofollow noreferrer">Django</a> defaults to Database Sessions while <a href="http://flask.pocoo.org/docs/latest/quickstart/#sessions" rel="nofollow noreferrer">Flask</a> defaults to Cookie Sessions.</p> <p><br/>More information:<br/> <a href="https://en.wikipedia.org/wiki/Session_(computer_science)" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Session_(computer_science)</a><br/> <a href="http://php.about.com/od/learnphp/qt/session_cookie.htm" rel="nofollow noreferrer">http://php.about.com/od/learnphp/qt/session_cookie.htm</a><br/> <a href="http://wonko.com/post/why-you-probably-shouldnt-use-cookies-to-store-session-data" rel="nofollow noreferrer">http://wonko.com/post/why-you-probably-shouldnt-use-cookies-to-store-session-data</a><br/> <a href="http://www.tuxradar.com/practicalphp/10/1/0" rel="nofollow noreferrer">http://www.tuxradar.com/practicalphp/10/1/0</a></p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload