156

I am training in web developement and am learning about JSP & Servlets. I have some knowledge of HttpSession - I have used it in some of my sample projects.

In browsers I have seen the option to "delete cookies". If I delete the cookies it deletes the HttpSession also.

Are cookies and session the same? What are the differences between them?

Rob Hruska
  • 111,282
  • 28
  • 160
  • 186
blacktiger
  • 18,007
  • 5
  • 18
  • 11

9 Answers9

306

A cookie is simply a short text string that is sent back and forth between the client and the server. You could store name=bob; password=asdfas in a cookie and send that back and forth to identify the client on the server side. You could think of this as carrying on an exchange with a bank teller who has no short term memory, and needs you to identify yourself for each and every transaction. Of course using a cookie to store this kind information is horrible insecure. Cookies are also limited in size.

Now, when the bank teller knows about his/her memory problem, He/She can write down your information on a piece of paper and assign you a short id number. Then, instead of giving your account number and driver's license for each transaction, you can just say "I'm client 12"

Translating that to Web Servers: The server will store the pertinent information in the session object, and create a session ID which it will send back to the client in a cookie. When the client sends back the cookie, the server can simply look up the session object using the ID. So, if you delete the cookie, the session will be lost.

One other alternative is for the server to use URL rewriting to exchange the session id.

Suppose you had a link - www.myserver.com/myApp.jsp You could go through the page and rewrite every URL as www.myserver.com/myApp.jsp?sessionID=asdf or even www.myserver.com/asdf/myApp.jsp and exchange the identifier that way. This technique is handled by the web application container and is usually turned on by setting the configuration to use cookieless sessions.

Suraj Jain
  • 3,857
  • 23
  • 38
Chris Cudmore
  • 28,156
  • 12
  • 52
  • 92
  • 29
    This is a wonderful explanation anchored in a great real-world analogy. This answer should be upvoted way more. Very accessible to newbies who are those most likely to ask such a question. – user798719 Aug 31 '13 at 06:38
  • 2
    What happens if I'm a user and someone else gets to know my session ID? – Maria Ines Parnisari Jan 13 '15 at 04:31
  • 3
    @I19 Possibly, they can impersonate you. This has happened in online gambling scenarios -- Sniff the hotel wifi, steal a session ID, and access the account. Securing a session is another story altogether. – Chris Cudmore Jan 13 '15 at 13:51
  • 2
    So who creates the cookie first ? Server or client ? Or is this application-dependant ? (I'd say server since otherwise it poses security threats, but I think it is worth mentionning ?) – nha Jun 14 '15 at 17:59
  • 4
    @nha The server creates the session and passes it in the response with the cookie. The session is created depending on the application logic when you want it to be created. The client can also create a cookie but it may not be of much use in the scenario of identifying the session because the server might not know what the value represents in the session. – Azeem Jul 13 '15 at 08:13
  • Regarding last paragraph about putting session ids in URL. Best reading up on why this should be avoided: https://security.stackexchange.com/questions/14093/why-is-passing-the-session-id-as-url-parameter-insecure – John Mar 17 '21 at 16:44
181

Sessions are server-side files that contain user information, while Cookies are client-side files that contain user information. Sessions have a unique identifier that maps them to specific users. This identifier can be passed in the URL or saved into a session cookie.

Most modern sites use the second approach, saving the identifier in a Cookie instead of passing it in a URL (which poses a security risk). You are probably using this approach without knowing it, and by deleting the cookies you effectively erase their matching sessions as you remove the unique session identifier contained in the cookies.

Eran Galperin
  • 83,588
  • 23
  • 113
  • 132
  • 10
    "_passing it in a URL (which poses a security risk)._" actually both approach have security risks (different ones). _Secret-ID in the URL_ can be made secure if done properly, and if the user understands that the URL is secret and cannot be posted in a public forum ever. – curiousguy Jul 06 '12 at 23:52
  • 1
    "The identifier can be passed in the URL or saved into a session cookie." . Where? client or server side? thank you for clarifying more . – Adib Aroui Nov 16 '14 at 11:55
  • 4
    @whitelettersandblankspaces The session cookie is stored on the client (and its value contains the unique session identifier which is sent with every request to map the browser session to the user session on the server). – WynandB Dec 15 '14 at 22:31
6

Cookies and session both store information about the user (to make the HTTP request stateful) but the difference is that cookies store information on the client-side (browser) and sessions store information on the server-side. A cookie is limited in the sense that it stores information about limited users and only stores limited content for each user. A session is not limit in such a way.

WynandB
  • 1,267
  • 13
  • 15
sanjay singh
  • 61
  • 1
  • 1
6

A lot contributions on this thread already, just summarize a sequence diagram to illustrate it in another way.

enter image description here

The is also a good link about this topic, https://web.stanford.edu/~ouster/cgi-bin/cs142-fall10/lecture.php?topic=cookie

Eugene
  • 8,507
  • 3
  • 35
  • 55
1

Cookie is basically a global array accessed across web browsers. Many a times used to send/receive values. it acts as a storage mechanism to access values between forms. Cookies can be disabled by the browser which adds a constraint to their use in comparison to session.

Session can be defined as something between logging in and logging out. the time between the user logging in and logging out is a session. Session stores values only for the session time i.e before logging out. Sessions are used to track the activities of the user, once he logs on.

RishikeshD
  • 189
  • 2
  • 4
0

Session in Asp.net:

1.Maintains the data accross all over the application.

2.Persists the data if current session is alive. If we need some data to accessible from multiple controllers acitons and views the session is the way to store and retreive data.

3.Sessions are server side files that contains user information. [Sessions are unique identifier that maps them to specific users]

Translating that to Web Servers: The server will store the pertinent information in the session object, and create a session ID which it will send back to the client in a cookie. When the client sends back the cookie, the server can simply look up the session object using the ID. So, if you delete the cookie, the session will be lost.

Vicky
  • 769
  • 2
  • 12
  • 28
0

Cookies are stored in browser as a text file format.It is stored limit amount of data.It is only allowing 4kb[4096bytes].$_COOKIE variable not will hold multiple cookies with the same name

we can accessing the cookies values in easily.So it is less secure.The setcookie() function must appear BEFORE the

<html>

tag.

Sessions are stored in server side.It is stored unlimit amount of data.It is holding the multiple variable in sessions. we cannot accessing the cookies values in easily.So it is more secure.

Bhargav Rao
  • 41,091
  • 27
  • 112
  • 129
Elangovan
  • 3,137
  • 3
  • 28
  • 37
  • Well, actually you can hold multiple data in cookies. Also, sessions can not really hold unlimited amount of data. You are pretty much limited by the amount of RAM you have. – Koray Tugay Feb 01 '16 at 13:59
0

Cookie is a way to implement the session between client and server, in this way session information stored in cookie. But this is not the only way to hold the session info, another way is store session info in Url.

lessisawesome
  • 1,225
  • 1
  • 10
  • 13
0

Google JSESSIONID. This will explain how the Servlet API initially uses URL re-writing and then, if cookies are enabled, cookies to manage sessions.

HTTP is stateless so the client browser must send the id of its session to the server with each request. The server, through whatever means, uses this id to retrieve any data for that session making it available for the lifetime of the request.

Nick Holt
  • 31,429
  • 4
  • 46
  • 56