Q & A about cookies and sessions

1. Session Cookie

If no expiration time is set, the cookie life cycle is the browser session period, As long as the browser window is closed, the cookie disappears. . This cookie is called Session Cookie . Session cookies are generally stored in memory instead of hard disks. If the expiration time is set, the browser will save the cookie to the hard disk, and then open the browser again. These cookies are still valid until the preset expiration time is exceeded. Cookies stored on hard disks can be shared among different browser processes, such as two IE Windows. For Cookies stored in the memory, different browsers have different processing methods. 2. seesionid and session Lifecycle When you access a website for the first time, the website server will add set-COOKIE: PHPSESSID = nj1tvkclp3jh83olcn3191sjq3 (PHP server) or set-Cookie JSESSIONID = keystore (Java Server) to the response header) information, This information is randomly generated by the server and stored in the server memory, To identify a unique client user, the content is unique, which is sessionid. When the browser obtains this sessionid, it will put it in its own process memory. Different browsers will be different here. The IE process cannot share this sessionid, that is, the new one. IE will not be able to share This sessionid can be shared among Firefox processes. then, when you send a request to the website, the browser will put the sessionid in the request header and send it to the server, so that the server will get the sessionid and then And stored in your memory Sessionid comparison Lock the client to differentiate different clients and complete the session. it can be seen that if this method is used, when the user closes the browser end process during the session process, the sessionid will disappear. If the user opens the browser and wants to continue the session, because the sessionid is not included in the sent request, the server cannot identify the session information sent to him ( At this time, the server's sessionid and sessionid point to the session still exist, but the correct sessionid does not match with it and occupies the server Server Memory , Memory is released only when the session expires or the server restarts. ). The preceding method is called session cookie. The cookie is stored in the browser memory and can only be used within the browser's memory range to complete the session. It is not a persistent method, persistent cookies are generated to solidify the cookie on the user's computer. The current cookie can not only store sessionid, but also store user information and style sheet information. if you disable the use of all cookies, neither session cookies nor persistent cookies can be used. A solution can also solve the problem, that is, URL rewriting, here we will talk about the effect that URL rewriting can only achieve session cookies, but persistent sessions cannot.