Sessions

Sessions let the server remember short-lived information about one visitor between requests. That is different from a cookie, which is stored in the browser, and different again from one-off form input, which only exists for the current request.

The dedicated session package is documented at https://www.php.gt/docs/Session/.

How WebEngine uses sessions

WebEngine sets up the session during the request lifecycle and places it in the service container. That means page logic and application code can request the session object directly when needed, rather than reaching into the superglobal $_SESSION.

The session can be accessed like any other dependency within the service container.

Common patterns

Typical session uses include:

• authentication state
• flash messages after redirects
• multi-step workflows

These are all cases where the browser needs to move from one request to the next while the server still remembers a little context.

Example storing the user's name in the session:

use GT\DomTemplate\Binder;
use GT\Session\Session;
use GT\Input\Input;

// Called on page request, if there's a name in the session, bind it to the page.
function go(Session $session, Binder $binder):void {
	if($name = $session->getString("name")) {
		$binder->bindKeyValue("name", $name);
	}
}

// Called when the user submits the form containing their name.
function do_set_name(Session $session, Input $input):void {
	$session->set("name", $input->getString("name"));
}

Storage and configuration

Session behaviour is configured through the normal WebEngine config files. The default setup is suitable for local development, but other handlers can be used too, including Redis-backed storage where that makes sense for deployment.

The session docs cover storage handlers, flash messages, and session stores in more detail:

• https://www.php.gt/docs/Session/Storage-handlers/
• https://www.php.gt/docs/Session/Flash-messages/

---

Now object-oriented methods are available for accessing cookies, sessions and user input, we can learn about protected globals.