A web session is the period during which a server treats a sequence of requests as coming from the same user. The server keeps state, such as login status or cart contents, and links it to the browser through a session ID.
Why it matters
HTTP does not remember anything between requests, so sessions provide continuity. Session length, storage and security determine whether users stay logged in, whether load-balanced servers agree on who they are, and whether attackers can hijack accounts.
Example
A user logs in. The server creates a record {user: 42, expires: +30 min} under a random ID such as f3a9... and sends Set-Cookie: sid=f3a9.... Each later request carries sid, the server looks it up and knows the user. After 30 idle minutes the record expires and the user must log in again.
Common mistakes
- Using predictable session IDs or putting them in URLs, where they leak through referrers and logs.
- Keeping sessions in one server's memory behind a load balancer, so users get logged out randomly.
- Never rotating the session ID after login.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.