Title: Session Author: Kriko Published: Mar 19, 2021 Last modified: Jul 12, 2026 --- 1. [Home](https://kriko.io/) / 2. [Glossary](https://kriko.io/glossary) / 3. S Letter # Session A **session** is a technical concept that refers to the period of interaction between a user and a website or application. In web development, a session helps preserve the user’s identity, preferences or temporary transaction data while the user navigates between pages. For example, when a user logs in to an e-commerce website, adds a product to the cart or performs an action in a member area, the continuity of this information across pages is maintained through session management. The concept of a session is often confused with cookies. Cookies are small pieces of data stored in the user’s browser. Session data, in many systems, is stored on the server, while a unique Session ID representing that session is sent to the user’s browser. This Session ID is usually stored inside a cookie, and the browser sends it to the server with each request. The server then uses this ID to access the relevant user’s session information. The Session ID is one of the most critical parts of session management. Instead of carrying all user information in the browser, session data is usually stored securely on the server and matched through this identifier. It can be thought of as a key; the user’s browser sends the Session ID to the server, and the server recognises the related session through that ID. For this reason, the Session ID must be generated securely, protected properly and prevented from being captured by third parties. Sessions significantly improve user experience. For example, after adding a pair of shoes to the cart on an e-commerce website, a user may return to category pages or the homepage. If the session or cart data is managed correctly, the product remains in the cart while the user continues browsing the website. Similarly, after logging in, the user does not need to enter their username and password again on every page. This structure is important for both user experience and transaction continuity. When a session ends depends on the system and security policy being used. Some sessions may end when the browser is closed, while others may expire automatically after a certain period of inactivity. Logging out, session timeout, server-side session cleanup or security-based invalidation can also end a session. Therefore, it is not accurate to say that a session always ends when the browser is closed. Session variables may include data such as username, user ID, permission level, cart information, preferred language or temporary transaction information. However, sensitive data such as passwords should not be stored openly inside a session. Personal data and authentication-related information should be kept as limited as possible, protected securely and managed with only the minimum required data. Session security is one of the most important security topics in web applications. Security weaknesses in session management can cause serious risks. In session hijacking attacks, malicious actors may try to obtain a valid Session ID and act as the user. To reduce this risk, secure cookie settings, HTTPS usage, session time limits, invalidation after logout and re-authentication for suspicious activity should be applied. Session IDs should also be generated in a strong and unpredictable way. In summary, a **session** is one of the core structures used to manage the temporary interaction process between a user and a website. It is used to maintain login status, store cart information, ensure transaction continuity across pages and provide personalised experiences. A properly structured session system improves user experience while also requiring careful design in terms of security and data protection. ## Discover it in the dictionary ### Pay Per Click (PPC) Pay Per Click, commonly abbreviated as PPC, is a digital advertising model in which advertisers pay when users click on their ads. In this… ### Spam Spam refers to unwanted messages sent without the recipient’s request or permission through email, SMS, social media, messaging applications or comment sections. These messages… ### Cache Cache is a technical concept that refers to temporarily storing frequently used data so it can be accessed more quickly later. In the web… ### Data Science Data science is an interdisciplinary field that aims to extract meaningful, usable and actionable insights from data. Smartphones, social media applications, e-commerce websites, online… ### Attribution Models Attribution models are measurement approaches that determine how conversion credit is distributed across the marketing channels, ads or interactions a user touches before completing… ### Agile Project Management Agile project management is an approach in which projects are divided into smaller parts and managed through continuous feedback and improvement cycles so that… ### Recommendation Engine A recommendation engine is a software system that suggests products, content or services to users based on their interests, past behaviour or the preferences… ### Urchin Tracking Module (UTM) UTM stands for Urchin Tracking Module and refers to parameters added to URLs in order to track which campaign, source or marketing channel brings… ### Predictive Analytics Predictive analytics is an analytical approach used to estimate future events, behaviours and outcomes. It applies patterns identified in historical and current data to… ## Track the digital heartbeat with Kriko Subscribe to receive curated insights, news, and ideas shaping the digital landscape. By checking this box, you acknowledge and accept our [privacy policy](https://kriko.io/privacy-policy).