ملفات Cookies مقابل الجلسات

Both cookies and sessions help your app remember a visitor, but they store data in very different places. Knowing which to pick matters. 🤔

A cookie is a small piece of text the browser keeps and sends back on every request to your site. The data lives on the client.

You set a cookie on the response object with set_cookie, giving it a name, a value, and optionally a lifetime.

Cookies arrive in request.COOKIES, a simple dictionary. Read your value back by its key on the next request.

A session keeps the real data on the server and sends the browser only a key. The visitor never sees the contents.

Because cookies sit in the browser, the user can read and edit them. So never store secrets like prices or user roles there.

Session data stays server-side, so it is the right home for anything sensitive or anything the user must not tamper with.

Cookies are tiny, capped near 4KB each, while sessions can hold much larger structures since they live in your database or cache.

Add HttpOnly so JavaScript cannot read a cookie, and Secure so it is only sent over HTTPS. Django sets these for sessionid by default.

Reach for a plain cookie for small, non-secret preferences like a theme or a chosen language that is fine for the user to see.

Use a session for login state, shopping carts, or anything private. It safely backs the cookie with trusted server storage.

You need to store a value the user must never read or change. What fits best?

You compared cookies and sessions: cookies store small, visible data on the client, sessions keep larger, private data on the server. Pick by sensitivity and size. 🎉