Overview

User sessions allow a web application to remember that a user has authenticated while they navigate between pages. Instead of requiring the user to log in on every page, the server creates a session and associates it with the user's browser.

1. Session Flow

code text

┌──────────────┐
│ User visits  │
│ Login Page   │
└──────┬───────┘
       │
       ▼
┌──────────────────┐
│ Submit username  │
│ and password     │
└──────┬───────────┘
       │
       ▼
┌─────────────────────────┐
│ Server verifies account │
│ using database          │
└──────┬──────────────────┘
       │
       ▼
┌─────────────────────────┐
│ Create authenticated    │
│ session                 │
│                         │
│ $_SESSION['user_id']    │
│ $_SESSION['user_role']  │
└──────┬──────────────────┘
       │
       ▼
┌──────────────────┐
│ Redirect to      │
│ Dashboard        │
└──────┬───────────┘
       │
       ▼
┌─────────────────────────┐
│ Every protected page    │
│ checks the session      │
└──────┬──────────────────┘
       │
       ├── Authenticated ──► Allow access
       │
       └── Not authenticated
                  │
                  ▼
             Login Page

2. What Is a Session?

A session is server-side state associated with a particular browser. After successful login, PHP can store:

code php

$_SESSION['user_id'] = 25;
$_SESSION['user_role'] = 'manager';
$_SESSION['user_email'] = 'user@example.com';

The browser receives a session identifier, usually through a cookie. On subsequent requests, PHP uses that identifier to retrieve the corresponding session data. The important distinction is:

The browser should contain only the session identifier, while sensitive session data remains on the server.

format_list_numbered Step 1 of 8

chevron_left Previous Next chevron_right