When to use URL/session/cookie variables?

Question

I do a lot of php and javascript, but I think this is relatively language-agnostic question. Are there any best-practices for when to use each of:

• URL variables
• SESSION variables
• cookies

I understand the inherent limitations of what some of them can't do, but it seems like their use can overlap sometimes, too, and those instances are what I'm really asking about.

---

EDIT Just to clarify: I'm pretty familiar with the technicalities of which method is stored where, and which the client/server can access. What I am looking for is something a little higher-level, like "temporary user settings should live in cookies, data state info should live on the server, etc..."

Thanks!

Answer 1

1. Sessions are stored on the server, which means clients do not have access to the information you store about them. Session data, being stored on your server, does not need to be transmitted in full with each page; clients just need to send an ID and the data is loaded from the server.

2. On the other hand, Cookies are stored on the client. They can be made durable for a long time and would allow you to work more smoothly when you have a cluster of web servers. However unlike Sessions, data stored in Cookies is transmitted in full with each page request. You should use cookie if you need longer logged-in sessions.

3. URL variables (GET) are open and can be seen by user. They are also useful as it allows the user to bookmark the page and share the link.

Answer 2

In general:

1. Use URL (GET) parameters for sending simple request parameters to the server, eg. a search query or the page number in a product listing.

2. Use session variables, as the name indicates, to store temporary data associated with a specific user session, eg. a logged-in user's ID or a non-persistent shopping cart.

3. Avoid using cookies when possible. Use them sparingly to store settings that are tied to a particular computer / user profile, eg. a setting such as "remember my user ID on this computer".

Answer 3

PHP embeds the session id directly into URLs when cookies are disabled. Then, the session id becomes a value accessible thru an HTTP GET variable.