<p>They are one in the same.</p>

<p>Craft simply renames it to "CraftSessionId" rather than the default "PHPSESSIONID".</p>

<p>The only additional things we do to it is set the "httpOnly" flag so that JavaScript can't read it and change the place it is saved to by default (varies per server) to <code>craft/storage/runtime/sessions</code>.</p>

<p>You can see that in action in <code>HttpSessionService</code>, which extends <a href="http://www.yiiframework.com/doc/api/1.1/CHttpSession" rel="nofollow">Yii's CHttpSession</a>, which is a convenient wrapper for PHP's session functionality.</p>

CC BY-SA 3.0
2014-07-24T21:51:19.677Z
Thanks Brad! Am I also correct in thinking that `session_start` is automatically called by Craft every time a page is loaded?
Lindsey D
CC BY-SA 3.0
2014-07-24T21:53:39.160Z
It'll be called the very first time HttpSessionService\CHttpSession get loaded and initialized in a request.
Brad Bell
CC BY-SA 3.0
2014-07-24T21:55:37.620Z
"JavaScript can't read it" ... Very good to know, actually impacts what I'm working on! Sounds like I'll need to have JS ping a Controller (which will then access the session in PHP).
Lindsey D
CC BY-SA 3.0
2014-07-24T22:10:53.433Z
Hah, it actually used to be open to JS (up until 2.0, I think), but you know... security and whatnot.
Brad Bell
CC BY-SA 3.0
2014-07-24T22:16:46.213Z
Ah yes... the dreaded whatnot. :)
Lindsey D
CC BY-SA 3.0
2014-07-24T21:46:24.063Z
2014-07-24T21:46:24.063Z
Brad Bell
<p>Doing some testing, and stumbled across the "CraftSessionId" cookie...</p>

<p>What's the difference between CraftSessionId and a normal PHP session? Is there any difference at all? What's the best way to refer to the current session?</p>

CC BY-SA 3.0
2014-07-28T03:25:00.493Z
Per [my conversation with Brad](http://craftcms.stackexchange.com/a/1382/45) and some additional digging around, I found that you can't _(read: shouldn't)_ use `session_start()`... Instead, you'll want to use `craft()->getSession()` to trigger a new session (or revive an existing one). Once you've done that, you'll be able to get your session ID normally via `session_id()`.
Lindsey D
<plugin-development><session>
What's the difference between CraftSessionId and a normal PHP session?
# What's the difference between CraftSessionId and a normal PHP session?

(Asked by: username_0 on 2014-07-24)

Doing some testing, and stumbled across the "CraftSessionId" cookie...

What's the difference between CraftSessionId and a normal PHP session? Is there any difference at all? What's the best way to refer to the current session?

**Tags:** plugin-development, session

> **Comments:**
> **username_0**: Per [my conversation with Brad](http://craftcms.stackexchange.com/a/1382/45) and some additional digging around, I found that you can't _(read: shouldn't)_ use `session_start()`... Instead, you'll want to use `craft()->getSession()` to trigger a new session (or revive an existing one). Once you've done that, you'll be able to get your session ID normally via `session_id()`.  

---

## 1 answers

### Answer by username_1 on 2014-07-24. Score: 3 | Accepted answer

They are one in the same.

Craft simply renames it to "CraftSessionId" rather than the default "PHPSESSIONID".

The only additional things we do to it is set the "httpOnly" flag so that JavaScript can't read it and change the place it is saved to by default (varies per server) to `craft/storage/runtime/sessions`.

You can see that in action in `HttpSessionService`, which extends [Yii's CHttpSession](http://www.yiiframework.com/doc/api/1.1/CHttpSession), which is a convenient wrapper for PHP's session functionality.

> **Comments:**
> **username_0**: Thanks Brad! Am I also correct in thinking that `session_start` is automatically called by Craft every time a page is loaded?  
> **username_1**: It'll be called the very first time HttpSessionService\CHttpSession get loaded and initialized in a request.  
> **username_0**: "JavaScript can't read it" ... Very good to know, actually impacts what I'm working on! Sounds like I'll need to have JS ping a Controller (which will then access the session in PHP).  
> **username_1**: Hah, it actually used to be open to JS (up until 2.0, I think), but you know... security and whatnot.  
> **username_0**: Ah yes... the dreaded whatnot. :)  

---

