基于客户端的会话和服务器端会话有什么区别？

Question

我正在了解 Flask 中的会话，并且在文档中它说：

“除了默认的基于客户端的会话之外，如果您想在服务器端处理会话，还有几个 Flask 扩展支持此功能。”

https://flask.palletsprojects.com/en/2.0.x/quickstart/#sessions

基于客户端的会话和服务器端有什么区别？

Answer 1

\n

除了该request对象之外，还有第二个对象，称为session which allows you to store information specific to a user from one request to the next. This is implemented on top of cookies for you and signs the cookies cryptographically. What this means is that the user could look at the contents of your cookie but not modify it, unless they know the secret key used for signing.

\n

\n

因此，信息物理存储在 cookie 中，例如username=john存储在 cookie 中的值。这就是“客户端会话”。如上所述，这样做的问题是用户可以看到该数据，如果您想在会话中存储秘密数据，这会很糟糕。如果您需要它，您需要服务器端会话，其中数据实际上存储在服务器端，并且客户端看到的只是一些随机的无意义的会话 ID。会话 ID 存储在 cookie 中，服务器根据该 id 在某个数据库中查找实际会话数据。

\n

The advantage of client-side sessions is that the server is entirely stateless, i.e. it doesn't need to store any data itself. That means it doesn't need to do any database lookup to get the data, and you can\xe2\x80\x94for example\xe2\x80\x94run several independent servers in parallel without needing to worry about having a shared session store, which is great for scalability.

\n

The advantage of server-side sessions is that you can store more data, as it doesn't need to be sent back and forth with every request, and that the data is not visible to the user.

\n