Sessions and Cookies Interview Questions

Q1. How do sessions work?

session_start() checks for a session ID cookie (PHPSESSID). If there is none, PHP creates a session and sends the ID. The data lives on the server (by default in files) and is loaded into $_SESSION for each request. The browser only holds the ID.

Q2. Where must session_start() be called?

Before any output, because it sends a cookie header. Otherwise: “headers already sent”.

Q3. What is the difference between a session and a cookie?

A cookie lives in the browser and can be read and edited by the user. A session keeps data on the server and uses a cookie only for the ID. Use sessions for anything private.

Q4. How do you set a secure cookie?

1
2
3
4
5
6
7
8

<?php
setcookie("theme", "dark", [
    "expires" => time() + 86400 * 30,
    "path" => "/",
    "secure" => true,
    "httponly" => true,
    "samesite" => "Lax",
]);

Secure: HTTPS only. HttpOnly: not readable by JavaScript. SameSite: limits cross-site sending.

Q5. Why is a new cookie not in $_COOKIE right away?

setcookie() sends a header with the response. $_COOKIE is filled from the request. It appears on the next request.

Q6. What is session fixation, and how do you prevent it?

An attacker makes the victim use a session ID the attacker knows, then waits for the victim to log in. Prevent it with session_regenerate_id(true) at login, session.use_strict_mode=1, and session.use_only_cookies=1.

Q7. How do you log a user out properly?

Clear $_SESSION, expire the session cookie, call session_destroy(), and redirect. Use a POST request with a CSRF token.

Q8. What should you store in a session?

Small, non-secret data: the user’s ID, a CSRF token, a flash message, a cart of IDs. Not passwords, and not whole database rows.

Q9. How would you implement “remember me” safely?

Create a random selector and validator. Store the selector and a hash of the validator in the database with an expiry. Put selector:validator in a long-lived HttpOnly cookie. On use, verify with hash_equals(), rotate the token, and delete it on logout. Never store the user ID or password in the cookie.

Q10. What is session locking?

By default, PHP locks the session file while a script runs, so a visitor’s parallel requests wait for each other. Call session_write_close() early when you only need to read.

Q11. How long does a session last?

Until the browser closes (a session cookie, by default), or until session.gc_maxlifetime seconds of inactivity allow cleanup. Implement your own idle and absolute timeouts for control.

Q12. What is a flash message?

A message stored in the session for one request, usually after a redirect (“Saved!”). It is read and then removed with unset().

Q13. Can you tell if a cookie was tampered with?

Not by itself. You can sign the value with hash_hmac() and a secret key and verify with hash_equals(). A signature proves it was not changed, but does not hide the content.

1
2
3
4
5
6
7
8
9

<?php
$key = "secret";
$value = "lang=hi";
$signed = $value . "." . hash_hmac("sha256", $value, $key);

[$v, $sig] = explode(".", $signed, 2);

var_dump(hash_equals(hash_hmac("sha256", $v, $key), $sig));
var_dump(hash_equals(hash_hmac("sha256", "lang=en", $key), $sig));

1
2

bool(true)
bool(false)

Q14. Why should a login send Cache-Control: no-store on private pages?

So the browser’s Back button does not show cached private pages after logout.

Q15. Where can sessions be stored besides files?

In a database, Redis or Memcached, by setting a custom session handler or the session.save_handler setting. The $_SESSION code does not change.