NESCO Junior Assistant Manager (ICT) Exam: 2021 (BUET)প্রশ্ন ও সমাধান

Cookies are small pieces of data stored on the client (browser); a session is server-side state tied to a client via a session identifier, usually delivered through a cookie.

Aspect	Cookie	Session
Storage location	Client-side (browser)	Server-side
Lifetime	Set explicitly via an expiry date/max-age; can persist across browser restarts	Typically ends when the browser closes or after a configured timeout
Size limit	About 4KB per cookie	Limited only by server memory
Dependency	Independent of any session	Usually depends on a cookie (the session ID) to identify the client
Clearing it	No dedicated unset function - cleared by setting an already-expired date via setcookie()	Cleared explicitly, e.g. session_destroy() in PHP
Security	Readable/editable by the client unless flagged HttpOnly/Secure - less secure by default	Data lives on the server, only an opaque ID is exposed to the client - generally more secure

• A typical flow: the server creates a session on the server and sends the client a cookie containing only the session ID; the browser resends that cookie on every request so the server can look up the matching session data.
• Practical rule: never store sensitive data (passwords, full card numbers) directly in a cookie - store only an opaque session ID, keep the real data server-side in the session.

Exam takeaway: cookie means client-side, size-limited, no dedicated unset function; session means server-side, backed by a cookie carrying just its ID, cleared via a destroy call - sessions are inherently more secure since the actual data never leaves the server.