Authentication · Lesson 4 of 7

Sessions

Manage authenticated server-side state with safe cookie configuration.

Lesson

Configure session cookies as Secure under HTTPS, HttpOnly, and an appropriate SameSite value. Regenerate the session identifier at privilege changes and invalidate server-side state at logout. Do not store sensitive secrets in client-readable cookies or trust an unverified session field. Session settings must be applied before session_start and reviewed for the deployment. Further guidance Use PHP password hashing APIs, regenerate a session identifier after authentication, and clear session state during logout. Authentication identifies the user; authorization checks whether that user may perform this action on this record. Rate-limit sensitive endpoints and keep failure messages generic. Practice task: Create a fresh example for Sessions. Predict the result before running it, then change one input and explain why the result changes. Test a normal case and one boundary or invalid case where it applies. Compare your output with the example and note one rule you would use in a real project.

Code examples

Sessions

PHP

session_set_cookie_params([
    'httponly' => true,
    'secure' => true,
    'samesite' => 'Lax',
]);
session_start();

Expected output

A session with safer browser cookie attributes

Key points

Manage authenticated server-side state with safe cookie configuration.
Store password hashes, not plaintext passwords.
Check authorization on every protected operation.

Your learning progress

Finish this lesson

Optional practice

PHP playground

This site does not execute learner-provided PHP code. Connect a secured PHP sandbox service before enabling code execution.

Execution is disabled. No code is sent to a server.