session persistence can be accomplished by using cookie in the pure client, so why do you need the session? on the server?
-
The running mechanism of
- session will generate a cookie of session_id for the client to save, and then the client will bring this session identifier to the server the next time it requests, and the server will find the session according to this.
- session persistence can also be achieved without using session, which is for sure
- maybe you"ll talk about security. But that"s what I don"t understand. The following is my personal test:
Log in to a website and copy the cookie of that site. Open the site (not logged in status) in another browser and fill in the copied cookie, refresh page, and the site becomes logged in. (I don"t mean all websites, just individual sites.)
as long as you steal cookie, you can hijack session. By the same token, if you only use cookie, then the same is true as long as you steal the cookie and you can impersonate the login.
if you steal cookie, both session and cookie will be impersonated, so why do you need session? I have read a lot of articles about session and cookie in general. Do anyone who really understand this principle tell me the real answer of this little white rookie?
