Lesson 01 · 10 min
Cookies and sessions
The server issues a ticket, the browser carries it in every request.
After sign-in the server creates a session (a record in a database or Redis) and returns its id in a cookie. The browser automatically adds the cookie to every request to that domain, and the server finds out who it is by the id. Signing out means deleting the session on the server.
- A session id is a long random string, not a user number.
- Issue a new session after sign-in so an old id can't be planted.
- Sessions are easy to revoke: delete the record and the user is signed out everywhere.
Check
Lock it in before you move on
1. What does the HttpOnly flag do?
2. What should a session cookie hold?
3. How do you sign out of every device with sessions?