Sessions and Cookies Authentication

# CHAPTER 5

Sessions and Cookies Authentication #

1. Introduction #

2. Learning Objectives #

• Explain the stateless nature of HTTP.

• Define what an HTTP Cookie is and how browsers manage them.

• Understand how server-side Sessions track user state.

• Trace the lifecycle of a Session ID from login to logout.

• Implement basic Session tracking in PHP.

3. Beginner-Friendly Explanation #

1. 1. Login: You show the Bouncer your ID. He verifies you are 21 and lets you inside.

1. 2. The Problem: You walk to the bar to buy a drink. The Bartender asks the Bouncer, "Is this guy 21?" The Bouncer has already forgotten you, so you have to show your ID again. If you want to go to the bathroom, you have to show your ID again.

1. 3. The Solution (Sessions): To fix this, when the Bouncer verifies your ID at the door, he puts a permanent marker number on your hand (e.g., "#402"). This is the Cookie. He writes "#402 = John Doe, Age 25" in his secret notebook (The Session Store).

1. 4. Subsequent Requests: When you go to the bar, you just hold up your hand. The Bartender reads "#402", checks the notebook, and instantly knows who you are without asking for your ID again.

4. What is a Cookie? #

5. What is a Session? #

1. 3. Server Creates Session: Server creates a new memory block in its RAM: SessionIDX789 -> {userid: 5, loggedin: true}.

1. 4. Server Sets Cookie: The Server responds to the browser with an HTTP Header: Set-Cookie: sessionid=X789.

1. 5. Client Clicks a Link: User clicks to view their Dashboard. The browser *automatically* sends the HTTP Header: Cookie: session_id=X789.

1. 6. Server Reads State: Server reads the incoming cookie, searches its RAM for X789, finds User ID 5, and returns the private Dashboard HTML.

1. 7. Logout: Server deletes X789 from its RAM and tells the browser to delete the cookie.

7. Implementation: PHP Sessions #

login.php

<?php
// CRITICAL: You must call session_start() before outputting ANY HTML!
session_start();

// ... assume password_verify() was successful for User ID 5 ...

// 1. Store the user's ID in the superglobal $_SESSION array
// PHP automatically generates a Session ID and sends the Set-Cookie header to the browser!
$_SESSION[&#039;user_id'] = 5;
$_SESSION[&#039;role'] = 'admin';

echo "Login successful!";
?>

dashboard.php (Protecting a Route)

<?php
session_start();

// 2. Check if the session variable exists
if (!isset($_SESSION[&#039;user_id'])) {
    // If no session exists, kick them back to login!
    header("Location: login.php");
    exit();
}

// 3. User is authenticated!
echo "Welcome to your private dashboard, User #" . $_SESSION['user_id'];
?>

logout.php

<?php
session_start();
// 4. Destroy the session data on the server
session_destroy();
// Redirect to home
header("Location: index.php");
exit();
?>

8. Backend Workflow: Scaling Sessions #

9. Best Practices #

• Secure Cookies: When configuring your server, you must set the Secure flag on your authentication cookies. This instructs the browser: "Only transmit this cookie over encrypted HTTPS connections." If sent over plain HTTP, anyone on the coffee shop Wi-Fi can intercept the Session ID and hijack the user's account.

• HttpOnly Cookies: Set the HttpOnly flag. This prevents frontend JavaScript from reading the cookie, neutralizing XSS (Cross-Site Scripting) attacks from stealing session tokens.

10. Common Mistakes #

• Headers Already Sent Error: In PHP, sessionstart() works by modifying HTTP headers to send the Cookie. HTTP headers must be sent *before* any HTML body content. If you write <h1>Welcome</h1> <?php sessionstart(); ?>, PHP will crash with a "Headers already sent" error. sessionstart() must be the very first line of your file.

1. 1. Explain why sensitive information (like an account balance or an isadmin flag) should be stored in the Server Session rather than directly inside the Browser Cookie.

12. Coding Challenges #

• Challenge: If you have XAMPP/PHP installed, write a script setsession.php that starts a session and sets $SESSION['color'] = 'blue'. Write a second script readsession.php that starts a session and echo $SESSION['color']. Open your browser's Developer Tools (F12) -> Application Tab -> Cookies. Find the auto-generated PHPSESSID cookie that links the two scripts together.

13. MCQs with Answers #

14. Interview Questions #

• Q: Detail the lifecycle of a Session-based authentication workflow. How does the server connect an incoming HTTP request to a specific user record in the database?

• Q: Explain the security purpose of the HttpOnly flag when setting a Session Cookie. What specific type of attack does it mitigate?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #