Safely knowing you're logged in, without using sessions.

Question

I heard in an old stackoverflow podcast that they minimized the use of sessions, and that they basically only needed it when posting. How can that be? Don't they need to use some form of sessions on every page view if nothing more than to tell that I'm logged in? How else do they show your username instead of the "Log In" prompt at the top of the screen?

When this type of thing becomes important is when you're persisting your sessions in a database. Now each time you touch your session store, you touch your database. So it would be great if you could avoid it.

You could store all your state in a cookie, but if you care at all about security, then you'll probably want to control state on your server instead.

Answer 1

I don't know about the podcast you're referring to, but I'm not really sure they were saying what you thought they were saying...

Session data doesn't necessarily have to be written to DB everytime it's touched. You could easily have a cached (using memcached or something similar) intermediary. You could then write the session data to DB every X amount of requests/minutes/writes/whatever.