Skip to main content

2. Sessions in PHP

What are sessions in PHP?​

Junior

Answer: A session is a way to store information (in variables) to be used across multiple pages. Unlike a cookie, the information is not stored on the user's computer; instead, it is stored on the server. Sessions are used to persist user data (like login status, shopping cart items) between different requests during a single visit to a website.

What is the role of cookies in sessions?​

Junior

Answer: Cookies are primarily used to store the Session ID on the client side. The session data itself remains on the server, but the cookie acts as a "key" that the browser presents to the server so it can identify which session data belongs to the current user.

Junior

Answer:

  • Storage: Cookies are stored on the client (browser); Sessions are stored on the server.
  • Security: Sessions are more secure as the actual data isn't exposed to the user.
  • Capacity: Cookies have a size limit (typically 4KB); Sessions can store much larger amounts of data.
  • Expiration: Cookies can persist for a long time; Sessions typically expire when the browser is closed or after a period of inactivity.

What should you store in sessions?​

Junior

Answer: You should only store essential, non-sensitive data that needs to persist across requests, such as the user's ID (to verify authentication), flash messages, or temporary state like a shopping cart. Avoid storing large objects, sensitive passwords (unhashed), or large amounts of data that could better be stored in a database.

How do sessions work under the hood?​

Middle

Answer: When a session starts (session_start()), PHP generates a unique session ID. This ID is typically sent to the user's browser as a cookie (named PHPSESSID by default). On subsequent requests, the browser sends this cookie back. PHP uses the ID to retrieve the session data from the server's storage (usually files in /tmp by default, but can be Redis or a database). The data is serialized internally before being saved.

What is the lifecycle of a PHP session?​

Middle

Answer: The lifecycle consists of four main phases: 1) Request Start (client sends the session cookie); 2) Initialization (session_start() locks the session storage, reads data, and populates $_SESSION); 3) Execution (the script modifies the session data); 4) Commit/Shutdown (PHP serializes $_SESSION, writes it back to storage, and releases the lock). Detailed Session Lifecycle

How do sessions work in RoadRunner, and are there limitations?​

Middle

Answer: In long-running environments like RoadRunner, the standard $_SESSION global and session_start() should be avoided because they rely on global state and file-based storage that doesn't scale well in persistent worker processes. Instead, you should use a centralized, non-blocking storage like Redis or a database, and manage session state via PSR-7 middleware or framework-specific session handlers (e.g., Laravel's session drivers) that don't depend on the traditional php-fpm session lifecycle.

How are sessions treated nowadays?​

Middle

Answer: Modern PHP development (especially with frameworks like Laravel or Symfony) treats sessions as an abstraction. Instead of manual $_SESSION manipulation, developers use Session services. For scalability, session data is rarely stored in files on the server anymore; instead, distributed stores like Redis, Memcached, or even the Database are used. For stateless APIs, sessions are often replaced by JWT (JSON Web Tokens).