会议是什么？他们是如何工作的？

本文翻译自：What are sessions? How do they work?

I am just beginning to start learning web application development, using python. 我刚刚开始使用python开始学习Web应用程序开发。 I am coming across the terms 'cookies' and 'sessions'. 我遇到了“cookies”和“会话”这两个词。 I understand cookies in that they store some info in a key value pair on the browser. 我理解cookie，因为它们将一些信息存储在浏览器的键值对中。 But I have a little confusion regarding sessions, in a session too we store data in a cookie on the user's browser. 但是我对会话有点困惑，在会话中我们也将数据存储在用户浏览器的cookie中。

For example - I login using username='rasmus' and password='default' . 例如 - 我使用username='rasmus'和password='default' 。 In such a case the data will be posted to the server which is supposed to check and log me in if authenticated. 在这种情况下，数据将被发布到服务器，如果经过身份验证，该服务器应该检查并登录。 However during the entire process the server also generates a session ID which will be stored in a cookie on my browser. 但是，在整个过程中，服务器还会生成会话ID，该ID将存储在浏览器的cookie中。 Now the server also stores this session ID in its file system or datastore. 现在，服务器还将此会话ID存储在其文件系统或数据存储中。

But based on just the session ID, how would it be able to know my username during my subsequent traversal through the site? 但基于会话ID，如何在我后续遍历网站时知道我的用户名？ Does it store the data on the server as a dict where the key would be a session ID and details like username , email etc. be the values? 它是否将数据作为dict存储在服务器上，其中密钥是会话ID，而username ， email等详细信息是值？

I am getting quite confused here. 我在这里很困惑。 Need help. 需要帮忙。

---

#1楼

参考：https://stackoom.com/question/FxeD/会议是什么-他们是如何工作的

---

#2楼

HTTP is stateless connection protocol, that is, the server cannot differentiate between different connections of different users. HTTP是无状态连接协议，即服务器无法区分不同用户的不同连接。

Hence comes cookie, once a client connects first time to a server, the server generates a new session id, which later will be sent to the client as cookie value. 因此来自cookie，一旦客户端第一次连接到服务器，服务器就会生成一个新的会话ID，稍后将以cookie值的形式发送给客户端。 And from now on, this session id will identify that client connection, because within each HTTP request it will see the appropriate session id inside cookies. 从现在开始，此会话ID将标识该客户端连接，因为在每个HTTP请求中，它将在cookie中看到相应的会话ID。

Now for each session id, the server keeps some data structure, which enables him to store data specific to user, this data structure you can abstractly call session. 现在对于每个会话id，服务器保留一些数据结构，这使他能够存储特定于用户的数据，这个数据结构可以抽象地调用会话。

---

#3楼

Because HTTP is stateless, in order to associate a request to any other request, you need a way to store user data between HTTP requests. 由于HTTP是无状态的，因此为了将请求与任何其他请求相关联，您需要一种在HTTP请求之间存储用户数据的方法。

Cookies or URL parameters ( for ex. like http://example.com/myPage?asd=lol&boo=no ) are both suitable ways to transport data between 2 or more request. Cookie或网址参数（例如http://example.com/myPage?asd=lol&boo=no ）都是在两个或更多请求之间传输数据的合适方式。 However they are not good in case you don't want that data to be readable/editable on client side. 但是，如果您不希望数据在客户端可读/可编辑，则它们并不好。

The solution is to store that data server side, give it an "id", and let the client only know (and pass back at every http request) that id. 解决方案是存储该数据服务器端，给它一个“id”，并让客户端只知道（并在每个http请求时传回）该id。 There you go, sessions implemented. 你去，会议实施。 Or you can use the client as a convenient remote storage, but you would encrypt the data and keep the secret server-side. 或者您可以将客户端用作方便的远程存储，但您可以加密数据并保留服务器端的秘密。

Of course there are other aspects to consider, like you don't want people to hijack other's sessions, you want sessions to not last forever but to expire, and so on. 当然还有其他方面需要考虑，比如你不希望别人劫持其他人的会话，你希望会话不会永远持续但会过期，等等。

In your specific example, the user id (could be username or another unique ID in your user database) is stored in the session data, server-side, after successful identification. 在您的特定示例中，用户标识（可以是用户数据库中的用户名或其他唯一标识）在成功标识后存储在服务器端的会话数据中。 Then for every HTTP request you get from the client, the session id (given by the client) will point you to the correct session data (stored by the server) that contains the authenticated user id - that way your code will know what user it is talking to. 然后，对于从客户端获得的每个HTTP请求，会话ID（由客户端提供）将指向包含经过身份验证的用户ID的正确会话数据（由服务器存储） - 这样您的代码就会知道用户是什么用户在说话。

---

#4楼

"Session" is the term used to refer to a user's time browsing a web site. “会话”是用于指代用户浏览网站的时间的术语。 It's meant to represent the time between their first arrival at a page in the site until the time they stop using the site. 它的意思是表示他们第一次到达网站页面之间的时间，直到他们停止使用网站为止。 In practice, it's impossible to know when the user is done with the site. 实际上，不可能知道用户何时完成了该站点。 In most servers there's a timeout that automatically ends a session unless another page is requested by the same user. 在大多数服务器中，超时会自动结束会话，除非同一用户请求另一个页面。

The first time a user connects some kind of session ID is created (how it's done depends on the web server software and the type of authentication/login you're using on the site). 用户第一次连接某种会话ID（如何完成取决于Web服务器软件以及您在网站上使用的身份验证/登录类型）。 Like cookies, this usually doesn't get sent in the URL anymore because it's a security problem. 像cookie一样，这通常不再在URL中发送，因为它是一个安全问题。 Instead it's stored along with a bunch of other stuff that collectively is also referred to as the session. 相反，它与一堆其他东西一起存储，这些东西统称为会话。 Session variables are like cookies - they're name-value pairs sent along with a request for a page, and returned with the page from the server - but their names are defined in a web standard. 会话变量就像cookie一样 - 它们是与页面请求一起发送的名称 - 值对，并随服务器页面一起返回 - 但它们的名称是在Web标准中定义的。

Some session variables are passed as HTTP headers . 一些会话变量作为HTTP标头传递。 They're passed back and forth behind the scenes of every page browse so they don't show up in the browser and tell everybody something that may be private. 它们在每个页面浏览的幕后来回传递，因此它们不会显示在浏览器中并告诉每个人可能是私密的。 Among them are the USER_AGENT, or type of browser requesting the page, the REFERRER or the page that linked to the page being requested, etc. Some web server software adds their own headers or transfer additional session data specific to the server software. 其中包括USER_AGENT，或请求页面的浏览器类型，REFERRER或链接到所请求页面的页面等。某些Web服务器软件添加自己的标头或传输特定于服务器软件的其他会话数据。 But the standard ones are pretty well documented. 但标准的文件很好。

Hope that helps. 希望有所帮助。

---

#5楼

Simple Explanation by analogy 简单的类比解释

Imagine you are in a bank, trying to get some money out of your account. 想象一下，你在银行里，试图从你的帐户中获取一些钱。 But it's dark; 但它是黑暗的; the bank is pitch black: there's no light and you can't see your hand in front of your face. 银行是黑色的：没有光，你看不到你的手在你面前。 You are surrounded by another 20 people. 你被另外20个人包围。 They all look the same. 它们看起来都一样。 And everybody has the same voice. 每个人都有同样的声音。 And everyone is a potential bad guy. 每个人都是潜在的坏人。 In other words, HTTP is stateless. 换句话说，HTTP是无状态的。

This bank is a funny type of bank - for the sake of argument here's how things work: 这家银行是一个有趣的银行类型 - 为了争论这里的事情是如何运作的：

1. you wait in line (or on-line) and you talk to the teller: you make a request to withdraw money, and then 你排队等候（或在线）并与出纳员交谈：你提出取钱的请求，然后
2. you have to wait briefly on the sofa, and 20 minutes later 你必须在沙发上等一下，20分钟后
3. you have to go and actually collect your money from the teller. 你必须去实际上从柜员那里收钱。

But how will the teller tell you apart from everyone else? 但出纳员将如何区别于其他人？

The teller can't see or readily recognise you, remember, because the lights are all out. 请记住，出纳员无法看到或容易认出你，因为灯光全都出来了。 What if your teller gives your $10,000 withdrawal to someone else - the wrong person?! 如果您的出纳员向其他人提供10,000美元的提款 - 错误的人怎么办？ It's absolutely vital that the teller can recognise you as the one who made the withdrawal, so that you can get the money (or resource) that you asked for. 出纳员可以将您识别为提款人，这样您就可以获得所要求的资金（或资源），这一点至关重要。

Solution: 解：

When you first appear to the teller, he or she tells you something in secret: 当您第一次看到出纳员时，他或她会秘密告诉您一些事情：

"When ever you are talking to me," says the teller, "you should first identify yourlself as GNASHEU329 - that way I know it's you". “当你和我说话的时候，”出纳员说，“你应该首先把自己称为GNASHEU329 - 我知道这就是你”。

Nobody else knows the secret passcode. 没人知道秘密密码。

Example of How I Withdrew Cash: 我如何撤回现金的示例：

So I decide to go to and chill out for 20 minutes and then later i go to the teller and say "I'd like to collect my withdrawal" 所以我决定去休息20分钟然后我去柜员说“我想收取我的提款”

The teller asks me: "who are you??!" 出纳员问我：“你是谁？！”

"It's me, Mr George Banks!" “这是我，乔治班克斯先生！”

"Prove it!" “证明给我看！”

And then I tell them my passcode: GNASHEU329 然后我告诉他们我的密码：GNASHEU329

"Certainly Mr Banks!" “当然是班克斯先生！”

That basically is how a session works. 这基本上就是会话的工作方式。 It allows one to be uniquely identified in a sea of millions of people. 它允许在数百万人的海洋中唯一地识别出一个人。 You need to identify yourself every time you deal with the teller. 每次与柜员打交道时都需要表明身份。

If you got any questions or are unclear - please post comment and i will try to clear it up for you. 如果您有任何疑问或不清楚 - 请发表评论，我会尽力为您解决。

Explanation via Pictures: 图片说明：

---

#6楼

Think of HTTP as a person(A) who has SHORT TERM MEMORY LOSS and forgets every person as soon as that person goes out of sight. 将HTTP视为具有短期记忆丢失的人（A），并且一旦该人消失，就会忘记每个人。

Now, to remember different persons, A takes a photo of that person and keeps it. 现在，为了记住不同的人，A拍摄那个人的照片并保留它。 Each Person's pic has an ID number. 每个人的照片都有一个身份证号码。 When that person comes again in sight, that person tells it's ID number to A and A finds their picture by ID number. 当那个人再次出现时，那个人告诉它的身份证号码给A和A按照身份证号码找到他们的照片。 And voila !!, A knows who is that person. 瞧!!，A知道那个人是谁。

Same is with HTTP. 与HTTP相同。 It is suffering from SHORT TERM MEMORY LOSS. 它正遭受短期内存损失。 It uses Sessions to record everything you did while using a website, and then, when you come again, it identifies you with the help of Cookies(Cookie is like a token). 它使用Sessions来记录您在使用网站时所做的一切，然后，当您再来时，它会在Cookie的帮助下识别您（Cookie就像一个令牌）。 Picture is the Session here, and ID is the Cookie here. 图片是此处的会话，ID是此处的Cookie。