Member Avatar for mohammed2raja

I want know more about session and cookies. How it maintain and what is it use using php. where all session variables are stored in differnet web server. How session is maintained in Apache server and ISS server. All depth information about server with example. Please give me some url from where i can get these.

  • 3 Contributors
  • 4 Replies
  • 114 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Shanti C

Dani AI

Generated

Good starting links from and . To expand on 's deeper questions: PHP sessions are server-side storage indexed by a session id. The id is the only thing sent in HTTP (via a Set-Cookie header or, if configured, URL rewriting). Session variables themselves live on the server, not in HTTP headers or in the client cookie.

Where the server stores session data depends on PHP configuration. The default handler is file-based and files are written to the path in session.save_path (ensure the web user can write there). Other handlers include memcached/Redis or a database via session.save_handler. The session file contains serialized PHP data keyed by the session id. To inspect the configured path at runtime use ini_get('session.save_path') or phpinfo().

Common pitfalls and practical tips:

  • Call session_start() before any output.
  • Protect cookies with session.cookie_httponly and session.cookie_secure and regenerate the id after privilege changes with session_regenerate_id(true). Example:
    <?php
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1); // only on HTTPS
session_start();
session_regenerate_id(true);
?>
  • File-based sessions obtain a lock on session_start(); for parallel requests release the lock early with session_write_close() after writes.
  • Garbage collection is controlled by session.gc_maxlifetime and the probability settings; on clustered hosts rely on a shared session store (memcached/Redis or central DB) or enable sticky sessions at the load balancer.
  • Apache vs IIS: PHP behavior is the same; differences are defaults (tmp path, service user) and file-permission details. On IIS/Windows check that the configured session.save_path is writable by the IIS user.

Short, concrete rules: the cookie carries only the id; session data lives where PHP is configured to keep it; for security regenerate ids and set cookie flags; for multi-server setups use shared storage or sticky sessions.

Recommended Answers

All 4 Replies

Member Avatar for srilakshmitr7

To know about sessions i think below url will help you..


Member Avatar for mohammed2raja

Thanks Shanti. Can i give me more url from where i get how sessions are stored in HTTP header like from depth.

Member Avatar for Shanti C

check these urls:

http://www.onlamp.com/pub/a/php/excerpt/webdbapps_8/

and try with different keywords at GOOOOOOGle.......

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.