What is session management and why is it important in web apps?

• A. Handling login state with tokens/cookies; improper management leads to session hijacking.
• B. Managing database backups.
• C. Ensuring hourly log rotation.
• D. Implement CSRF tokens only.

Answer: (A)

Managing login state across HTTP requests is what session management is all about. Web applications don’t remember who you are by default, so a system is needed to recognize a user as they move from page to page. This is usually done by issuing a session identifier stored in a cookie or a token. The server keeps the actual session data (who the user is, what they’re allowed to do, what they’ve done so far) and uses the identifier from each request to load that data.

Getting this right is crucial because if the session identifier or the mechanism that carries it isn’t protected, someone else could steal it and impersonate the user—session hijacking. That’s why best practices matter: use secure transmission (HTTPS), mark cookies as HttpOnly so client-side scripts can’t grab them, apply SameSite rules to limit cross-site requests, keep session lifetimes reasonable, rotate tokens, and invalidate sessions on logout. Well-designed session management ensures a user’s identity and permissions persist safely across pages and actions, while poorly managed sessions open the door to unauthorized access.

Other options miss the full scope: database backups are about data preservation, not user state across requests; log rotation is about maintaining logs, not user sessions; CSRF tokens address a related security concern but don’t describe how login state is tracked and maintained across requests.