Cookie-based sessions vs database sessions in Django - Quick Revision & Key Differences

Recall & Review

beginner

What is a cookie-based session in Django?

A cookie-based session stores all session data directly inside the user's browser cookie. Django signs the cookie to prevent tampering but does not store session data on the server.

beginner

How does a database session work in Django?

A database session stores session data on the server in the database. The user's browser only keeps a session ID cookie that references the stored data.

intermediate

Name one advantage of cookie-based sessions.

They reduce server load because session data is stored on the client side, so the server does not need to read or write session data for each request.

intermediate

What is a key security concern with cookie-based sessions?

Since session data is stored on the client, it can be exposed if not properly secured. Although signed, sensitive data should not be stored in cookies to avoid leaks.

intermediate

Why might you choose database sessions over cookie-based sessions?

Database sessions allow storing larger and more complex data securely on the server, and they avoid exposing session data to the client.

In Django, where is session data stored when using cookie-based sessions?

A In a server-side file

B Inside the user's browser cookie

C In the server's database

D In the server's memory only

Cookie-based sessions store all session data inside the user's browser cookie.

What does Django store in the user's cookie when using database sessions?

A Only a session ID

B No cookie is stored

C User's password

D The entire session data

Django stores only a session ID in the cookie, which references the session data stored in the database.

Which session type reduces server storage needs?

A Cookie-based sessions

B File-based sessions

C Database sessions

D Cache-based sessions

Cookie-based sessions store data on the client side, reducing server storage needs.

What is a risk of storing sensitive data in cookie-based sessions?

A Server load increases

B Data can be lost if the server crashes

C Cookies expire too quickly

D Data can be tampered with or exposed

Sensitive data in cookies can be exposed or tampered with despite signing, so it is risky to store it there.

Which session type is better for storing large amounts of data securely?

A Cookie-based sessions

B URL-based sessions

C Database sessions

D Local storage sessions

Database sessions store data securely on the server and can handle larger data sizes.

Explain the main differences between cookie-based sessions and database sessions in Django.

Think about client vs server storage and what each session type keeps in the cookie.

When would you choose to use cookie-based sessions over database sessions in a Django project?

Consider performance and data sensitivity.

Practice

1. What is the main difference between cookie-based sessions and database sessions in Django?

easy

A. Both store data only on the server but in different database tables.

B. Cookie-based sessions store data on the client browser, while database sessions store data on the server.

C. Both store data only on the client browser but use different encryption methods.

D. Cookie-based sessions store data on the server, while database sessions store data on the client browser.

Solution

1. Step 1: Understand where session data is stored

   Cookie-based sessions keep the session data inside the user's browser cookies. Database sessions keep the data on the server side in a database.

2. Step 2: Compare storage locations

   Since cookie sessions store data client-side and database sessions store data server-side, this is the key difference.

3. Final Answer:

   Cookie-based sessions store data on the client browser, while database sessions store data on the server. -> Option B

4. Quick Check:

   Storage location = client vs server [OK]

Hint: Remember: cookies = browser, database = server [OK]

Common Mistakes:

• Confusing client and server storage
• Thinking both store data only on server
• Assuming cookie sessions use server database

2. Which setting in Django controls whether sessions use cookies or the database?

easy

A. SESSION_ENGINE

B. SESSION_COOKIE_NAME

C. SESSION_SAVE_EVERY_REQUEST

D. SESSION_EXPIRE_AT_BROWSER_CLOSE

Solution

1. Step 1: Identify session-related settings

   Django uses several settings for sessions, but the one that controls the backend storage is SESSION_ENGINE.

2. Step 2: Understand SESSION_ENGINE role

   Changing SESSION_ENGINE switches between cookie-based sessions and database sessions.

3. Final Answer:

   SESSION_ENGINE -> Option A

4. Quick Check:

   Session backend = SESSION_ENGINE [OK]

Hint: SESSION_ENGINE sets session storage type [OK]

Common Mistakes:

• Choosing cookie name instead of engine
• Confusing save frequency with storage
• Mixing expiration with storage setting

3. Given this Django setting: SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies', what happens when you store a large amount of data in the session?

medium

A. The data is stored securely on the server database.

B. The data is split between cookie and database automatically.

C. The session will raise an error and not save any data.

D. The data is stored in the user's browser cookie, which may cause size issues.

Solution

1. Step 1: Identify the session backend

   The setting 'signed_cookies' means session data is stored in browser cookies, signed for security.

2. Step 2: Consider cookie size limits

   Browser cookies have size limits (usually around 4KB). Storing large data can cause issues or truncation.

3. Final Answer:

   The data is stored in the user's browser cookie, which may cause size issues. -> Option D

4. Quick Check:

   Signed cookies = client storage, watch size limits [OK]

Hint: Signed cookies store data client-side, watch size limits [OK]

Common Mistakes:

• Assuming data is stored server-side
• Thinking Django splits data automatically
• Expecting error instead of silent truncation

4. You switched SESSION_ENGINE to use database sessions but your session data is not saving. Which is the most likely cause?

medium

A. You set SESSION_COOKIE_NAME incorrectly.

B. You did not clear browser cookies before testing.

C. You forgot to run migrations to create the session table.

D. You used the wrong database engine in settings.

Solution

1. Step 1: Understand database session requirements

   Database sessions require a database table to store session data, created by migrations.

2. Step 2: Identify missing migration impact

   If migrations are not run, the session table does not exist, so session data cannot be saved.

3. Final Answer:

   You forgot to run migrations to create the session table. -> Option C

4. Quick Check:

   Database sessions need session table migration [OK]

Hint: Run migrations after switching to database sessions [OK]

Common Mistakes:

• Blaming cookies instead of database setup
• Changing cookie name unrelated to saving
• Confusing database engine with session table

5. You want to store sensitive user data in sessions and ensure it is not exposed to the client. Which session backend should you choose and why?

hard

A. Use database sessions because data is stored server-side and not exposed to the client.

B. Use cookie-based sessions because they are encrypted and secure.

C. Use cookie-based sessions because they are faster and store data locally.

D. Use database sessions but also store data in cookies for backup.

Solution

1. Step 1: Consider data sensitivity and storage location

   Sensitive data should not be stored in client-accessible places like cookies, even if encrypted.

2. Step 2: Choose backend that keeps data server-side

   Database sessions store data on the server, protecting it from client access and tampering.

3. Step 3: Evaluate options

   Use database sessions because data is stored server-side and not exposed to the client. correctly chooses database sessions for sensitive data security.

4. Final Answer:

   Use database sessions because data is stored server-side and not exposed to the client. -> Option A

5. Quick Check:

   Sensitive data = server storage [OK]

Hint: Sensitive data? Store server-side with database sessions [OK]

Common Mistakes:

• Assuming cookie encryption is enough
• Mixing speed with security needs
• Trying to duplicate data in cookies and DB