RECALL

order.php

order.view.php

RECALL

Prologue

Why is a cookie like a remora?

Let's try something

1. Open browser in Guest Mode (clean slate).
2. Pop open the Application tab.
   
    
3. Pop open the Network tab, select Doc.
4. Go to GitHub.com.
   
    
5. Pop open the Application tab.
   
    
6. Pop open the Network tab and go to the Sign in link.

In summary...

RECAP

• Cookies are small blobs of text in key/value format that your browser is allowed to save.
• We can see cookies using our browser tools (for example, in the Application tab in Chrome & Edge and Storage in Firefox).
  • Because of this, what sort of things should you NOT store in cookies?
• Cookies are associated with a domain.  You don't see ALL your cookies in the devtools, only the ones relevant to the page you're currently on.
• There's an Expires field; values seem to be a date/time stamp or Session.
• Cookies are created by a browser when it receives a Set-Cookie header in a response.
• After a cookie has been created, it's "stuck" (like a remora!) to further requests your browser makes. The cookies will appear in your Request Headers in a Cookie entry.

I think you should be summarizing like this, but I'm feeling all generous like.

What flavours of cookies are there and how do I bake them?

1-cookies

DEMO

make-a-cookie.php

1-cookies

DEMO

mood.php

RECAP

• Use setcookie() to set cookies; they can be session cookies or persistent cookies. 
  • Use strtotime() to make your persistent cookie code readable.
  • Modify the path to / if you want the cookie to be available within the entire domain.
• A session cookie will go away when the browser window (not just tab) is closed.
• A persistent cookie will stay until it expires. (Though I've been noticing odd behaviour on Codespaces.)
• Use the $_COOKIE superglobal to get a cookie value.
  • Gotcha: you can't use $_COOKIE to set a cookie - that's what setcookie() is for!
  • Don't forget to see if the cookie is there by using isset() or !empty().

What's a common cookie gotcha?

2-cookie-gotcha

DEMO

gotcha.php

RECAP

• Your PHP can't write anything to the response before calling setcookie().
  • So no echoes, no markup, and no function calls that write to the response.
  • This makes sense, right? Cookies are created by a Set-Cookie Response Header. And headers are, by definition at the HEAD of a response. If you write anything other than a header to the response and THEN attempt to write a header...it's not a header anymore!

Why does the client get all the state fun?

RECAP

• Just like a browser can store little blobs of text, so can your web server store little blobs of text in some location (the session store) of the server's hard drive.
  • In our Codespaces, this location is /tmp. You can see the session files (along with some other stuff) by using the command ls /tmp.
  • You can spot a session file because it starts with sess_ followed by a hella-long ID.
• Session files contain key/value pairs, kinda like a cookie; unlike cookies, there is some extra information stored that indicates the type of data stored. 

How do I read/write delicious data to the session store?

3-sessions

DEMO

start-a-session.php

3-sessions

DEMO

open-page.php

RECAP

• You can use the session store in your code if you call session_start(). Once that's done, you can use the $_SESSION superglobal in the same way you can use $_GET and $_POST.
• When you call session_start(), important things happen:
  • A unique ID for your session is created.
  • The page response will have a request to make a cookie with the key PHPSESSID and the unique ID as the value.
  • An empty file will be placed in the session store called sess_(unique ID).
  • From this point onward, using $_SESSION will write/read things from the file!
• If you delete the PHPSESSID cookie using your dev tools, you can trick your code into thinking you're not connected to the session anymore.
  • This is useful if you're hacking around...but it DOES leave the session file in your session store. You can delete it with rm (name of session file).
  • If you want to see how to properly get rid of a session, see the logout.php code in lab-03!

What's a common session gotcha?

3-session-gotcha

DEMO

order-is-important.php

3-session-gotcha

DEMO

writing-gotcha.php

3-session-gotcha

DEMO

reading-gotcha.php

RECAP

• If you attempt to call session_start() after writing anything to the response, it'll blow up. Why? Think back to cookies....
• If you forget to call session_start() and go $_SESSION['key']=(some value), then you're not actually writing to the session store! You're just writing  to an array called $_SESSION!
• If you forget to call session_start() and then try to access the session (like echo $_SESSION['foo']), it'll blow up, because the $_SESSION variable doesn't exist!