Difference between session and cookies in php

Question

Today, we're going to discuss about two common things, that are Session and Cookies, which are used in the website to keep track of the information provided by the users, but for different purposes. A lot of beginners are confused about their characteristics, functionalities, and differences. In this study blog, we'll explore both of them in a more comprehensive way.

 Table of Contents:

1. Introduction to Session and Cookies
2. Difference between Session and Cookies
3. Storage Location
4. Security
5. Lifetime
6. Stored Data Type
7. Purpose of Usage
8. The Conclusion
9. The Reference

Introduction to Session and Cookies #

• Session

  Session is used to store information across the multiple pages of a website momentarily on the server-side files. It's useful when the website needs to track who is the current user across multiple pages of the same website. Let's look at the example:

  1. A user is using a POST method to send a request to the server for logging in the website.
  2. The information provided is sent to the server for validation via HTTP context.
  3. However, the HTTP context doesn't maintain the state of a user. As a result, the server is able to validate the current user at the moment only when the request is sent. The other pages are not informed about who is the current user.
  4. To overcome this limitation, the server will generate a unique session ID for that particular user and sent back to be stored in the browser in form of Cookie.
  5. Whenever the user navigates across different pages, as long as the user is showing the consistent and valid session ID, different pages may recognize the same user.
  6. Finally, a session will end and the cookie is deleted (if expiration date is not set) when a user log out or the application is shut down.

• Cookies

  Cookies is used to remember the user information such as browsing history, user preferences and login credentials on the client-site computer. It can only store maximum of 4KB data in the browser. The server will forget everything about the user such as his/her credentials and activities after the connection breaks. Hence, Cookies are very useful when you want a browser to "remember" the user. Let's look at the example:

  1. A user, called "Alex" has chosen Keep me signed in and logged in to a website, his login credentials are stored in a Cookies and the server creates a session ID for him and sent back to the browser.
  2. While navigating across multiple pages of the website, he's able to use his unique session ID to verify he's the current user.
  3. After a few moment, he feels tired and close the browser.
  4. When he comes back again and open the website, the browser will send a request to the server to get the web page, the Cookies belongings to that page will be added to the request via HTTP headers.
  5. Since Cookies remembers his login credentials, it'll check the informtion against the server, and thus log in "Alex" automatically.
  6. The lifetime of Cookies can be set and it's deleted when its lifetime has passed..
  Note Since Cookies are stored on client-site computer, it can only be accessed by the user that initially created it. Other user cannot see it.

Now, we've some basic understanding on what is Session and Cookies. Let's go through their differences.

Difference between Session and Cookies #

Although both are used to track the information provided by the users, they still have some distinct differences. Let's see one by one:

Storage Location #

• Session

  A Session is stored as server-site files temporarily on the server. It'll be deleted when the application is shut down or the user logged out.

• Cookies

  A Cookies is stored as a client-site files on the user's computer. It'll be deleted when the expiration date has reached.

Security #

• Session

  A Session is more secure compare to a Cookies because it's on server-site and cannot be tampered easily. Besides, the data in a Session is encrypted and converted to binary form in the server.

• Cookies

  A Cookies is less secure because it's stored in the form of string text file on the client's computer. Whenever an unauthorized user get access to the system, he can alter the data easily.
  Caution When you choose "Keep me logged in", if someone has stolen the unique identifier in the cookies, it's called cookie stealing and now they can access your account. Always be aware of this option!

Lifetime #

• Session

  A Session will be deleted once the user logs out or the application is shut down.

• Cookies

  A Cookies is deleted when the user specified expiration date has passed.

Stored Data Type #

• Session

  A Session stores the any type of value or the data type of an Object.

• Cookies

  A Cookies can only stores data in "string" type only.

Purpose of Usage #

• Session

  A Session is used to track an user's activity over a period of time. It's used to store the specific information of a user which should be consistent across multiple pages of a website. The example can be login status, user preferences, and shopping cart. When a user logs in the website, a session is generated in the server-site and the unique session ID is generated and stored in the user's devices as a cookie.

• Cookies

  A Cookies are used to store user's information in their computer or mobile device to "remember" their information such as tracking login information, user behavior and storing user preferences. When the next time they visit the same website, the browser'll send the Cookies along with the request to get the web page which compromises of more personalized and desired data for that particular user.

The Conclusion #

In this study blog, we've learned what's Session and Cookies, what are their differences in term of storage location, security, lifetime, stored data type, and purpose of usage. Bear in mind, both of them have their own pros and cons, but Session is more secure compared to Cookies. Hence, you should choose which one to use according to your own condition.

The Reference #

You may go through this reference for more information:

1. What's Session and Cookies: https://docs.oracle.com/en/middleware/webcenter/sites/12.2.1.3/wbcsd/sessions-and-cookies1.html#GUID-F8F240F3-E769-4B8C-8B7C-3886010D27BE