How session variables work

Session variables store information (usually form or URL parameters submitted by users) and make it available to all of a web application’s pages for the duration of the user’s visit. For example, when users log on to a web portal that provides access to e‑mail, stock quotes, weather reports, and daily news, the web application stores the login information in a session variable that identifies the user throughout the site’s pages. This allows the user to see only the types of content they have selected as they navigate through the site. Session variables can also provide a safety mechanism by terminating the user’s session if the account remains inactive for a certain period of time. This also frees server memory and processing resources if the user forgets to log off a website.

Session variables store information for the life of the use session. The session begins when the user opens a page within the application and ends when the user does not open another page in the application for a certain period of time, or when the user explicitly terminates the session (typically by clicking a “log-off” link). While it exists, the session is specific to an individual user, and every user has a separate session.

Use session variables to store information that every page in a web application can access. The information can be as diverse as the user’s name, preferred font size, or a flag indicating whether the user has successfully logged in. Another common use of session variables is to keep a running tally, such as the number of questions answered correctly so far in an online quiz, or the products the user selected so far from an online catalog.

Session variables can only function if the user’s browser is configured to accept cookies. The server creates a session ID number that uniquely identifies the user when the session is first initiated, then sends a cookie containing the ID number to the user’s browser. When the user requests another page on the server, the server reads the cookie in the browser to identify the user and to retrieve the user’s session variables stored in the server’s memory.