Javascript 什么是 cookie 和会话，它们是如何相互关联的？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/11142882/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What are cookies and sessions, and how do they relate to each other?
提问by Blanktext
I am trying to understand cookies and sessions professionally. I know that when a browser connects to a server, the server "asks" the browser to "paste" a cookie with "phpsessid" in the client browser cookies folder.
我正在尝试专业地理解 cookie 和会话。我知道当浏览器连接到服务器时，服务器“要求”浏览器在客户端浏览器 cookie 文件夹中“粘贴”带有“phpsessid”的 cookie。
Now that we have the "phpsessid", if the client enters the server the browser sends to the server the "phpsessid" and the server takes a look at the tmp folder and if we have a match it loads back every data the user has for this client, but I am kinda confused with the process.
现在我们有了“phpsessid”，如果客户端进入服务器，浏览器会向服务器发送“phpsessid”，服务器会查看 tmp 文件夹，如果我们有匹配项，它会加载回用户拥有的所有数据这个客户，但我对这个过程有点困惑。
I will be thankful if some one can help me understand those processes of creating a session and cookies - what is happening behind the scenes.
如果有人能帮助我理解创建会话和 cookie 的过程 - 幕后发生的事情，我将不胜感激。
回答by Madara's Ghost
Let's go through this:
让我们来看看这个：
Cookiesand sessionsare both ways to preserve the application's state between different requests the browser makes. It's thanks to them that, for instance, you don't need to log in every time you request a page on StackOverflow.
Cookie和会话都是在浏览器发出的不同请求之间保存应用程序状态的两种方式。多亏了他们，例如，您不必每次在StackOverflow上请求页面时都登录。
Cookies
饼干
Cookies are small bits of data, (maximum of 4KB long), which hold data in a key=value pairs:
Cookie 是一小段数据（最大长度为 4KB），将数据保存在键=值对中：
name=value; name2=value2
These are set either by JavaScript, or via the server using an HTTP header.
这些是由JavaScript设置的，或者是通过服务器使用HTTP 标头设置的。
Cookies have an expiry datetime set, example using HTTP headers:
Cookie 设置了到期日期，例如使用 HTTP 标头：
Set-Cookie: name2=value2; Expires=Wed, 19 Jun 2021 10:18:14 GMT
Which would cause the browser to set a cookie named name2with a value of value2, which would expire in about 9 years.
这会导致浏览器设置了一个名为cookie的name2使用的价值value2，这将在到期大约9年。
Cookies are considered highly insecurebecause the user can easily manipulate their content. That's why you should always validate cookie data. Don't assume what you get from a cookie is necessarily what you expect.
Cookie 被认为是高度不安全的，因为用户可以轻松操纵其内容。这就是为什么您应该始终验证 cookie 数据的原因。不要假设您从 cookie 中得到的东西一定是您所期望的。
Cookies are usually used to preserve login state, where a username and a special hash are sent from the browser, and the server checks them against the database to approve access.
Cookie 通常用于保存登录状态，其中从浏览器发送用户名和特殊哈希值，服务器根据数据库检查它们以批准访问。
Cookies are also often used in sessionscreation.
Cookie 也经常用于会话创建。
Sessions
会话
Sessions are slightly different. Each user gets a session ID, which is sent back to the server for validation either by cookieor by GET variable.
会话略有不同。每个用户都会获得一个会话 ID，该ID会通过cookie或GET 变量发送回服务器进行验证。
Sessions are usually short-lived, which makes them ideal in saving temporary state between applications. Sessions also expire once the user closes the browser.
会话通常是短暂的，这使得它们非常适合在应用程序之间保存临时状态。一旦用户关闭浏览器，会话也会过期。
Sessions are considered more secure than cookies because the variables themselves are kept on the server. Here's how it works:
会话被认为比 cookie 更安全，因为变量本身保存在服务器上。这是它的工作原理：
- Server opens a session (sets a cookie via HTTP header)
- Server sets a session variable.
- Client changes page
- Client sends all cookies, along with the session ID from step 1.
- Server reads session ID from cookie.
- Server matches session ID from a list in a database (or memory etc).
- Server finds a match, reads variables which are now available on
$_SESSIONsuperglobal.
- 服务器打开一个会话（通过 HTTP 标头设置一个 cookie）
- 服务器设置会话变量。
- 客户变更页面
- 客户端发送所有 cookie 以及步骤 1 中的会话 ID。
- 服务器从 cookie 中读取会话 ID。
- 服务器从数据库（或内存等）中的列表中匹配会话 ID。
- 服务器找到匹配项，读取现在可用于
$_SESSION超全局变量的变量。
If PHP does not find a match, it will start a new session, and repeat the steps from 1-7.
如果 PHP 没有找到匹配项，它将开始一个新会话，并重复 1-7 的步骤。
You can store sensitive information on a session because it is kept on the server, but be aware that the session ID can still be stolen if the user, let's say, logged in over an insecure WiFi. (An attacker can sniff the cookies, and set it as its own, he won't see the variables themselves, but the server will identify the attacker as the user).
您可以在会话中存储敏感信息，因为它保存在服务器上，但请注意，如果用户通过不安全的 WiFi 登录，会话 ID 仍然可能被盗。（攻击者可以嗅探cookie，并将其设置为自己的，他自己不会看到变量，但服务器会将攻击者识别为用户）。
That's the gist of it. You can learn more on the PHP manual on both subjects.
这就是它的要点。您可以在 PHP 手册中了解有关这两个主题的更多信息。
