Understanding Sessions

Originally, a session is a visit of a user to a website. He clicks on a few links, has a look at a couple of pages, and then leaves. This defines a session. Or, to put it in other words: If a user does not request any data from a website for a period of time, for example 20 minutes, the session ends.

HTTP does not know any kind of session mechanism; the protocol is stateless. However, PHP comes with a built-in session support that makes it fairly easy to use sessions.

After a session is created, PHP generates a session ID, that is, a long string that identifies the session. PHP then creates a file or a database entry for this session. Then, the PHP application can store data in this session. This data is then written either into the session file or into the database (shared memory is another, but rarely used option).

So, the only thing that must be transported between the client and the server is the session ID. All other data relevant to the session resides at the server. So, no sensitive data is sent over the wire an unnecessary amount of times.

The configuration of PHP's session mechanism is completely triggered in the [session] section of the php.ini configuration file. The default settings might not be suitable for all applications, so the next few phrases cover some possible configurations.