Sessions

Sessions store user state on the server between requests. A session ID (usually in a cookie) links the client to its server-side session data.

How Sessions Work

1. User logs in
   POST /api/login { username, password }

2. Server creates session
   session_id = generate_uuid()
   store.set(session_id, { userId: 123, role: "admin" })

3. Server sends session cookie
   Set-Cookie: session_id=abc-123; HttpOnly; Secure

4. Subsequent requests include cookie
   Cookie: session_id=abc-123

5. Server looks up session
   session = store.get("abc-123")
   user = session.userId  // 123

Session Storage Options

Session vs JWT

Session-Based Auth:
Client --> Cookie(session_id) --> Server
                                  |
                                  +--> Lookup session in store
                                  +--> Return user data

JWT-Based Auth:
Client --> Header(Authorization: Bearer <token>) --> Server
                                                    |
                                                    +--> Decode token
                                                    +--> Extract user data

Session Security

• Generate cryptographically random IDs
• Set appropriate timeout
• Implement session fixation protection
• Use secure cookie flags

Configuration

HttpOnly: true
Secure: true
SameSite: Lax/Strict
Path: /
Max-Age: appropriate timeout

Best Practices

• Invalidate on logout
• Implement concurrent session limits
• Monitor session anomalies

Key Points

• Understanding Sessions is essential for production systems
• Always consider scalability and maintainability
• Test thoroughly before deploying to production
• Monitor performance and set up alerting

Common Patterns

1. Validation: Always validate input at the boundary
2. Error Handling: Use structured error responses
3. Logging: Log key events for debugging
4. Testing: Unit, integration, and load tests
5. Documentation: Keep docs updated with code changes