My current site uses a session to store all the items in a customers shopping cart. Of course a session will only last so long, so if the visitors came back in perhaps a few hours, or even the next day or so, their shopping cart items would be forgotten.

If I used a cookie, then I could keep the items in the cart for a month or so. So that if they returned then they will know the items they were interested in ordering, without having to try and remember and re-searching for them.

So is it better to be using a cookie? Is there an industry standard, and a good reason for people using a session? I know you can store more data using a session, but this is just an array of a few items, so shouldnt be much data anyway.

  • 1
    Neither works out well if the user decides to visit your site on two different devices. Jan 30, 2015 at 23:03

2 Answers 2


The session is stored on the server whereas the cookies is stored on the user desktop.

In the session, you have no way to retrieve the cart's information after the session is expired (generally 30 minutes at most). You will throw away 2 hours of Paula's time, who has struggled to choose that red shirt over the green one.

Cookies's size and number are indeed limited and it would be frustrating to have only half of your cart saved.

Another difference is that some people don't accept cookies. The session solution would work anywhere.

You have two more fair options :

  1. database : to be able to push emails pushing him to buy the stuff. Or if you wan't the user to access his cart on any device.

  2. localstorage : which is basically a cookie 2.0. It doesn't work on very old browsers though.

If you don't have special needs, cookies or local storage is a good deal.


You are not limited to these two options, really.

First, let me clarify some confusion.

Every session has an identifier used to match a particular browser with a set of data being stored on the server. That identifier has to be stored on a user's device somehow - using cookies or trans_sid. Note that the session.use_trans_sid approach uses the resource URLs to pass the session id, and is not a very popular way to handle this. In most of the cases, sessions use cookies anyway. It means that you can't be sure that:

Another difference is that some people don't accept cookies. The session solution would work anywhere.

PHP, for example, uses cookies for sessions by default. That means that in case users have cookies disabled, the sessions are not likely to work either.

You have ways to control the session expiration time - look at how do the social network sites remember you for months. The session lifetime consists of two parts:

  1. for how long does a user device remember the session, i.e. store the session ID and use it for authentication; and
  2. for how long does the server store the associated data, i.e. is able to match the session ID provided with a set of data generated and stored during a corresponding visit

If you're using cookies to store the session id then increase their lifetime - just like you said, for a month or so. Then configure the server auto-cleanup process to keep sessions for that month or so.

If you're passing the ID in the URL then it will be stored for as long as the user has that URL, but again, the server configuration will have to be adjusted accordingly as well.

As suggested above, a good idea would be to associate the cart to an actual user account or email, that way if a session expires or gets lost (a user has cleaned the cookies or reinstalled the browser or just logged on from a different device) you can always restart it using the customer's email or username and preload the data.

Another point about cookies is that their contents are viewable by the users, e.g. if you store some tracking information there, it may be viewed or altered by the users.

Either way, it feels like the question belongs to Stackoverflow

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.