Session (computer networking)

This article needs more citations. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Session" computer networking – news · newspapers · books · scholar · JSTOR (July 2014) (Learn how and when to remove this message)

In computer science and networking, a session is a two-way link, a relatively high layer in the OSI stack enabling interactive information exchange between two or more communication devices or ends – be they computers, automated systems, or live active users (see login session). A session is established at a certain point in time, and then 'torn down' - brought to an end - at some later point. A session may involve more than one message in each direction. A session is typically stateful, meaning that at least one of the communicating parties needs to hold current state information to be able to communicate.

An established session is the basic requirement to perform a connection-oriented communication. A session also is the basic step to transmit in connectionless communication modes. However, any unidirectional transmission does not define a session.^{[1][unreliable source?]}

Communication Transport may be implemented as part of protocols and services at the application layer, at the session layer or at the transport layer in the OSI model.

• Application layer examples:
  • HTTP sessions, which allow associating information with individual visitors
  • A telnet remote terminal session
• Session layer example:
  • A Session Initiation Protocol (SIP) based Internet phone call
• Transport layer example:
  • A TCP session, which is synonymous to a TCP connection, or an established TCP socket.

In the case of transport protocols that do not implement a formal session layer (e.g., UDP) or where sessions at the protocl level are too short-lived, sessions are maintained by a higher level program. For example, a HTTP exchange between a browser and a remote host that includes a HTTP cookie with a unique session ID may identify a state such as information about the user's preferences or authorization level.

Maintaining session continuity between HTTP requests requires a session ID. The session ID is embedded within the <A HREF> or <FORM> links of dynamic web pages so that it is passed back to the CGI. CGI then uses the session ID to ensure session continuity between transaction phases.

Session affinity

When a client may connect to any server in a cluster of servers, a special problem is encountered in maintaining consistency when the servers must maintain session state. The client must either be directed to the same server for the duration of the session, or the servers must transmit server-side session information via a shared file system or database. Otherwise, the client may reconnect to a different server than the one it started the session with, which will cause problems when the new server does not have access to the stored state of the old one.

A method of using server-side sessions without persistent storage is to utilize RAM for storage of session data.

Client-side web sessions

Client-side sessions use cookies and encryption to preserve state on the client without storing data on the server. When presenting a dynamic web page, the server sends the current state data to the client (web browser) in the form of a cookie. The client saves the cookie in memory or on disk. With each successive request, the client sends the cookie back to the server, and the server uses the data to "recall" the state of the application for that specific client and generate an appropriate response.

To accomplish this securely, the server needs to encrypt the session data before sending it to the client, and modification of such information by any other party should be prevented via cryptographic means.

Transmitting state back and forth with every request is only practical when the size of the stored information is small.

HTTP session token

A session token is a unique identifier that is generated and sent from a server to a client to identify the current interaction session. The client usually stores and sends the token as an HTTP cookie and/or sends it as a parameter in GET or POST queries. The reason to use session tokens is that the client only has to handle the identifier—all session data is stored on the server (usually in a database, to which the client does not have direct access) linked to that identifier. Examples of the names that some programming languages use when naming their HTTP cookie include JSESSIONID (JSP), PHPSESSID (PHP), CGISESSID (CGI), and ASPSESSIONID (ASP).

Session management

This section may contain original research. Please improve it by verifying the claims made and adding inline citations. Statements consisting only of original research should be removed. (August 2026) (Learn how and when to remove this message)

In human–computer interaction, session management is the process of keeping track of a user's activity across sessions of interaction with the computer system.

Typical session management tasks in a desktop environment include keeping track of which applications are open and which documents each application has opened, so that the same state can be restored when the user logs out and logs in later. For a website, session management might involve requiring the user to re-login if the session has expired (i.e., a certain time limit has passed without user activity). It is also used to store information on the server-side between HTTP requests.

See also

• HTTPS
• REST
• Session ID
• Sessionization
• Session fixation
• Session poisoning

References

External links

• Sessions by Doug Lea