Sessions & Cookies Interview Questions

Sessions store data on the server with a unique session ID sent to client via cookie, while cookies store data directly on the client's browser. Sessions are more secure for sensitive data and expire when browser closes by default, while cookies can persist for specified durations.

session_start() initiates or resumes a session. It must be called before any output is sent to browser. It generates a unique session ID, creates/loads the session file on server, and sets a session cookie. It also loads existing session data into $_SESSION superglobal.

Cookies are set using setcookie() function: setcookie(name, value, expire, path, domain, secure, httponly). They can be retrieved using $_COOKIE superglobal array. Parameters control cookie lifetime, visibility, and security settings.

Key security considerations include: using session_regenerate_id() to prevent session fixation, setting secure and httponly flags, implementing session timeout, validating session data, proper session destruction, and securing session storage location.

Session timeout can be implemented by: setting session.gc_maxlifetime in php.ini, storing last activity timestamp in session, checking elapsed time on each request, and destroying session if timeout exceeded. Also consider implementing sliding expiration.

Session hijacking occurs when attacker steals session ID to impersonate user. Prevention includes: using HTTPS, setting secure/httponly flags, regenerating session IDs, implementing IP validation, using token-based authentication, and proper session timeout.

Complete session destruction requires: session_unset() to clear variables, session_destroy() to destroy session data, clearing session cookie using setcookie(), and unset($_SESSION) array. Best practice includes clearing all related cookies and session data.

PHP supports various session handlers: files (default), database, memcached, redis. Custom handlers can be implemented using SessionHandler interface. Each has advantages for different scenarios (scalability, persistence, performance).

Remember me involves: generating secure token, storing hashed token in database, setting long-lived cookie with token, validating token on subsequent visits. Implementation should include token rotation, secure storage, and proper expiration handling.

Session fixation occurs when attacker sets victim's session ID. Prevention includes: regenerating session ID on login/privilege change using session_regenerate_id(true), validating session data, and implementing proper session security measures.

Distributed sessions require: centralized storage (Redis/Memcached), consistent session handling across servers, proper load balancing configuration, implementing sticky sessions or session replication, and handling failover scenarios.

Cookie limitations include: size (4KB), number per domain, browser settings blocking cookies. Workarounds include: using local storage for larger data, implementing fallback mechanisms, splitting data across multiple cookies, server-side storage alternatives.

Secure session validation includes: checking user agent consistency, validating IP address (with caution), implementing CSRF tokens, validating session age, checking session data integrity, and implementing proper authentication checks.

session_cache_limiter() controls HTTP caching of pages with sessions. Options include: nocache, private, public, private_no_expire. Affects how browsers and proxies cache session pages. Important for security and proper page caching.

SameSite cookie attribute controls how cookie is sent with cross-site requests. Values: Strict, Lax, None. Helps prevent CSRF attacks and protects against cross-site request attacks. Important for modern web security compliance.

Key options include: session.save_handler, session.save_path, session.gc_maxlifetime, session.cookie_lifetime, session.cookie_secure, session.cookie_httponly. These control session behavior, storage, lifetime, and security settings.

Custom session handling requires implementing SessionHandlerInterface with methods: open, close, read, write, destroy, gc. Used for custom storage solutions or specific session management requirements. Must handle all session operations properly.

Garbage collection removes expired session data. Controlled by session.gc_probability, session.gc_divisor, and session.gc_maxlifetime settings. Process runs randomly based on probability settings. Important for server resource management.

AJAX session handling includes: implementing session checks in AJAX calls, handling session timeout responses, providing user feedback, implementing automatic logout, and managing session refresh mechanisms. Consider implementing keepalive requests.

HTTP-only cookies cannot be accessed by JavaScript, protecting against XSS attacks. Set using httponly parameter in setcookie() or session configuration. Important security measure for sensitive cookies like session IDs.

Session authentication involves: validating credentials, storing user data in session, implementing session security measures, handling remember me functionality, implementing proper logout, and managing session expiration.

Flash data persists for only one request cycle, commonly used for temporary messages. Implementation involves storing data in session, checking for data existence, displaying data, and removing after use. Often used for success/error messages.

Concurrent access handling includes: implementing session locking mechanisms, using database transactions for session storage, handling race conditions, implementing proper session state management, and considering distributed session storage.

Secure cookies are only transmitted over HTTPS. Set using secure parameter in setcookie() or session configuration. Should be used for all sensitive data and session cookies when site uses HTTPS. Essential for maintaining transport security.

Cross-subdomain sessions require: setting session cookie domain to main domain, configuring session handler for shared access, managing session security across subdomains, and handling domain-specific session data appropriately.

Best practices include: using HTTPS, setting secure/httponly flags, implementing proper session timeout, regenerating session IDs, validating session data, secure storage, proper destruction, and implementing CSRF protection.

Session migration involves: copying session data to new storage, updating session handler configuration, managing transition period, handling failover scenarios, and ensuring data consistency. Important for system upgrades or architecture changes.

Domain cookies are accessible across subdomains. Set using domain parameter in setcookie(). Used for maintaining user state across subdomains, implementing single sign-on, sharing necessary data between related sites. Requires careful security consideration.

Multi-server synchronization requires: centralized session storage, consistent configuration across servers, handling race conditions, implementing proper locking mechanisms, and managing session replication or shared storage.

Session adoption occurs when taking over existing session. Security implications include: potential session fixation attacks, need for proper validation, importance of session regeneration, and implementing proper authentication checks. Requires careful implementation.