Web Development, Session Management

I've been learning some web stuff recently, and one big question on my mind...which surprisingly I couldn't bring right up on a google search (though I'm probably expressing it wrong), is how session state is coordinated within a website project, or even one part of a website project?

For instance, a session variable can be anything....like Session["Username"], Session["DaUser"], Session["OurEsteemedUser"]. Get what I"m saying? Are there standards within each company to keep these things on the same page, or are common variables built into new web technologies?

I know this is a very vague question, but hopefully you get my drift.

A simpler method that we use for some of our internal sites is passing a hashed session id along with each link, i.e. index.php?id=wsrtgnsorijknsoijrnosrt (HTTP GET). Then you can look up the session id and details from a database.

You can do this in a more silent fashion with HTTP POSTs, which the user will not see but will be transferred to the server.

Note that you always have to be security conscious; you have to verify the session for every page and give the session id an expiration, renew when you go to a different page, etc.

if you have access to the HTTP headers on both the client and server end, you could store a session id there as well, but if it's a web page intended to be viewed in a browser, that sort of eliminates that possibility.

Quote:

---

Originally Posted by Epy

A simpler method that we use for some of our internal sites is passing a hashed session id along with each link, i.e. index.php?id=wsrtgnsorijknsoijrnosrt (HTTP GET). Then you can look up the session id and details from a database.

You can do this in a more silent fashion with HTTP POSTs, which the user will not see but will be transferred to the server.

Note that you always have to be security conscious; you have to verify the session for every page and give the session id an expiration, renew when you go to a different page, etc.

---

Cool, so the database is where the organization comes in, then. That is, the agreed upon names and allowed parameters for variables belonging to each customer. It's just weird when you are cobbling some little thing together on your own and you are making up variables as you go with no consistency checks other than your ability to keep things straight.

It's just like using variables in programming. The C standard doesn't tell you what you should call your variables. You just make them up as you go along and keep your records straight.