Cookie-based sessions vs database sessions in Django - Hands-On Comparison

Cookie-based Sessions vs Database Sessions in Django

📖 Scenario: You are building a simple Django web app that tracks user visits using sessions. You want to understand how to set up cookie-based sessions and database sessions, and see how Django handles session data differently in each case.

🎯 Goal: Build a Django project that first uses cookie-based sessions to store a visit count, then switch to database sessions to store the same data. Learn how to configure session engines and access session data in views.

📋 What You'll Learn

Create a Django view that increments a visit count stored in the session

Configure Django to use cookie-based sessions

Change configuration to use database sessions

Verify session data is stored and retrieved correctly in both modes

💡 Why This Matters

🌍 Real World

Web apps often track user data like login status or preferences using sessions. Understanding different session backends helps choose the best storage for security and scalability.

💼 Career

Django developers must configure and manage sessions securely. Knowing cookie vs database sessions is essential for building reliable user experiences.

1

Set up a Django view to track visits using sessions

Create a Django view function called visit_counter that uses request.session to increment a session variable visits. Initialize visits to 1 if it does not exist. Return an HttpResponse with the text showing the number of visits.

Django

from django.http import HttpResponse

def visit_counter(request):
    # Your code here

Hint

Use request.session.get('visits', 0) to read the current count, then add 1 and save it back.

2

Configure Django to use cookie-based sessions

In your Django settings.py, set the session engine to 'django.contrib.sessions.backends.signed_cookies' by assigning SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'.

Django

from django.http import HttpResponse

def visit_counter(request):
    visits = request.session.get('visits', 0) + 1
    request.session['visits'] = visits
    return HttpResponse(f"Number of visits: {visits}")

# Set SESSION_ENGINE to cookie-based sessions below
# Your code here

Hint

Set SESSION_ENGINE exactly to 'django.contrib.sessions.backends.signed_cookies' in settings.py.

3

Switch Django to use database sessions

Change the SESSION_ENGINE setting in settings.py to 'django.contrib.sessions.backends.db' to store session data in the database.

Django

from django.http import HttpResponse

def visit_counter(request):
    visits = request.session.get('visits', 0) + 1
    request.session['visits'] = visits
    return HttpResponse(f"Number of visits: {visits}")

# Change SESSION_ENGINE to database sessions below
# Your code here

Hint

Set SESSION_ENGINE exactly to 'django.contrib.sessions.backends.db' in settings.py.

4

Complete setup by running migrations for database sessions

Run Django migrations to create the session table by adding django.contrib.sessions to INSTALLED_APPS if not present, then run python manage.py migrate sessions to create the session table.

Django

from django.http import HttpResponse

def visit_counter(request):
    visits = request.session.get('visits', 0) + 1
    request.session['visits'] = visits
    return HttpResponse(f"Number of visits: {visits}")

SESSION_ENGINE = 'django.contrib.sessions.backends.db'

# Add 'django.contrib.sessions' to INSTALLED_APPS and run migrations
# Your code here

Hint

Make sure 'django.contrib.sessions' is in INSTALLED_APPS list in settings.py.

Practice

1. What is the main difference between cookie-based sessions and database sessions in Django?

easy

A. Both store data only on the server but in different database tables.

B. Cookie-based sessions store data on the client browser, while database sessions store data on the server.

C. Both store data only on the client browser but use different encryption methods.

D. Cookie-based sessions store data on the server, while database sessions store data on the client browser.

Solution

1. Step 1: Understand where session data is stored

   Cookie-based sessions keep the session data inside the user's browser cookies. Database sessions keep the data on the server side in a database.

2. Step 2: Compare storage locations

   Since cookie sessions store data client-side and database sessions store data server-side, this is the key difference.

3. Final Answer:

   Cookie-based sessions store data on the client browser, while database sessions store data on the server. -> Option B

4. Quick Check:

   Storage location = client vs server [OK]

Hint: Remember: cookies = browser, database = server [OK]

Common Mistakes:

• Confusing client and server storage
• Thinking both store data only on server
• Assuming cookie sessions use server database

2. Which setting in Django controls whether sessions use cookies or the database?

easy

A. SESSION_ENGINE

B. SESSION_COOKIE_NAME

C. SESSION_SAVE_EVERY_REQUEST

D. SESSION_EXPIRE_AT_BROWSER_CLOSE

Solution

1. Step 1: Identify session-related settings

   Django uses several settings for sessions, but the one that controls the backend storage is SESSION_ENGINE.

2. Step 2: Understand SESSION_ENGINE role

   Changing SESSION_ENGINE switches between cookie-based sessions and database sessions.

3. Final Answer:

   SESSION_ENGINE -> Option A

4. Quick Check:

   Session backend = SESSION_ENGINE [OK]

Hint: SESSION_ENGINE sets session storage type [OK]

Common Mistakes:

• Choosing cookie name instead of engine
• Confusing save frequency with storage
• Mixing expiration with storage setting

3. Given this Django setting: SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies', what happens when you store a large amount of data in the session?

medium

A. The data is stored securely on the server database.

B. The data is split between cookie and database automatically.

C. The session will raise an error and not save any data.

D. The data is stored in the user's browser cookie, which may cause size issues.

Solution

1. Step 1: Identify the session backend

   The setting 'signed_cookies' means session data is stored in browser cookies, signed for security.

2. Step 2: Consider cookie size limits

   Browser cookies have size limits (usually around 4KB). Storing large data can cause issues or truncation.

3. Final Answer:

   The data is stored in the user's browser cookie, which may cause size issues. -> Option D

4. Quick Check:

   Signed cookies = client storage, watch size limits [OK]

Hint: Signed cookies store data client-side, watch size limits [OK]

Common Mistakes:

• Assuming data is stored server-side
• Thinking Django splits data automatically
• Expecting error instead of silent truncation

4. You switched SESSION_ENGINE to use database sessions but your session data is not saving. Which is the most likely cause?

medium

A. You set SESSION_COOKIE_NAME incorrectly.

B. You did not clear browser cookies before testing.

C. You forgot to run migrations to create the session table.

D. You used the wrong database engine in settings.

Solution

1. Step 1: Understand database session requirements

   Database sessions require a database table to store session data, created by migrations.

2. Step 2: Identify missing migration impact

   If migrations are not run, the session table does not exist, so session data cannot be saved.

3. Final Answer:

   You forgot to run migrations to create the session table. -> Option C

4. Quick Check:

   Database sessions need session table migration [OK]

Hint: Run migrations after switching to database sessions [OK]

Common Mistakes:

• Blaming cookies instead of database setup
• Changing cookie name unrelated to saving
• Confusing database engine with session table

5. You want to store sensitive user data in sessions and ensure it is not exposed to the client. Which session backend should you choose and why?

hard

A. Use database sessions because data is stored server-side and not exposed to the client.

B. Use cookie-based sessions because they are encrypted and secure.

C. Use cookie-based sessions because they are faster and store data locally.

D. Use database sessions but also store data in cookies for backup.

Solution

1. Step 1: Consider data sensitivity and storage location

   Sensitive data should not be stored in client-accessible places like cookies, even if encrypted.

2. Step 2: Choose backend that keeps data server-side

   Database sessions store data on the server, protecting it from client access and tampering.

3. Step 3: Evaluate options

   Use database sessions because data is stored server-side and not exposed to the client. correctly chooses database sessions for sensitive data security.

4. Final Answer:

   Use database sessions because data is stored server-side and not exposed to the client. -> Option A

5. Quick Check:

   Sensitive data = server storage [OK]

Hint: Sensitive data? Store server-side with database sessions [OK]

Common Mistakes:

• Assuming cookie encryption is enough
• Mixing speed with security needs
• Trying to duplicate data in cookies and DB