Where user state lives.
DEFAULT BEHAVIOUR
PHP stores session data in files on the server by default, usually in your account's tmp directory.
PRACTICAL ISSUES
Session files accumulate and consume inodes. Garbage collection removes expired ones, but on shared hosting this is not always reliable. Clean the directory periodically.
Sessions do not persist across servers, which matters only if you later move to multiple servers.
ALTERNATIVES
Database-backed sessions, which are portable and queryable but add database load Redis or Memcached, where available, which is fastest Token-based state carried by the client, avoiding server-side sessions entirely
CACHING AND SESSIONS
Any page that varies by session must not be cached, or one visitor sees another's data.
This is the most serious caching error and it happens regularly. Exclude authenticated pages explicitly.
SECURITY
Set session cookies as secure and HTTP-only Regenerate the session identifier on login, preventing session fixation Set a reasonable expiry Do not put sensitive data in a cookie
DEBUGGING
Sessions lost between requests usually means the storage path is unwritable, or a caching layer is interfering.
