When should I use session variables instead of coo

Question

Session variables and cookies seem very similar to me. I understand the technical differences, but how do you decide when to use one vs. the other?

Answer 1

• Sessions are stored on the server, which means clients do not have access to the information you store about them. Session data, being stored on your server, does not need to be transmitted in full with each page; clients just need to send an ID and the data is loaded from the server.

• On the other hand, cookies are stored on the client. They can be made durable for a long time and would allow you to work more smoothly when you have a cluster of web servers. However, unlike sessions, data stored in cookies is transmitted in full with each page request.

• Avoid storing data in cookies

  • It can be seen, read and manipulated by the end user, or intercepted by those with nefarious intent. You can't trust any data in cookies, except for the "session_id".
  • It increases your bandwidth, if you add 1k of data per page request per user, that might increase your bandwidth by 10-15%. This is perhaps not costly from a $$ perspective, but it could be from a performance perspective. It effectively would decrease your bandwidth on a per server by 10-15%, i.e., it might cause you to need more servers.

• What you can store in session data depends on the amount of data and number of users you have. no_of_users * size_of_session_data must be less than the free memory available on your server.

Answer 2

Cookies can persist longer than a single session. However, cookies may also be deleted by the user, or you may have a user whose browser does not accept cookies (in which case only a server-side session will work).

Answer 3

Use sessions only if the data is too big for cookies or if the data is so big that it would decrease the performance if you used cookies.

For example, if you are saving smaller data then the size of a session ID in your cookie, like two login tokens or something similar... Then I don't see why you would use sessions over cookies.

Also note that PHP session files are saved to disk by default, compared to cookies, which are saved only on the client side.

Answer 4

One of the drawbacks of PHP sessions is how session handling works. Specifically, only one process/request can have a session open for writing at a time. Upon

session_start() 

the session file is locked. If more processes come along, the rest pile up and wait their turn.

In other words, if you are using AJAX on a page to update several elements - you do not want the AJAX requests opening up the same session - they will be forced into a queue and if one of those requests get stuck - it will not release the session - resulting in a browser hang where opening up a new tab or window only puts another unfillable request into the queue on the server. Using

session_write_close()

as soon as possible to release the session is a partial work-around.

A long running request with a user getting bored and opening up more windows could have the same browser hanging effect.

I recommend avoiding PHP sessions.

Answer 5

Sessions are stored on the server side. If a visitor stores something in a cookie, the browser will send the user information for every request made.

This tends to consume a lot of servers computer time and slowing the user's experience. Some browsers also do not support cookies giving more advantage to sessions over cookies... I strongly recommend sessions.

This might help: Cookies (php.net)

Answer 6

Your definite Guide

N.B - A cookie is stored on users' browsers, and a session is stored on your hosting server machine.

When to Use

1. Use a cookie when you want your application to remember user's data always, even when they have closed their browsers. E.g whenever you type www.facebook.com it takes you to your account, even when your browser has been closed and re-opened.

   Because any data kept in a session is cleared off once you close your browser.

2. Use a cookie when the user information to be stored is much larger than normal. ... With a session, if you have a larger user base, like Facebook, think of how it will look storing all user sessions on the hosting machine.

3. Use a session when the user information to be stored is not larger than normal, and you don't want the public to have access to your user variables...