{"id":2316,"date":"2025-10-21T22:55:02","date_gmt":"2025-10-21T15:55:02","guid":{"rendered":"https:\/\/kienthucmo.com\/?p=2316"},"modified":"2025-10-21T22:56:01","modified_gmt":"2025-10-21T15:56:01","slug":"session-trong-lap-trinh-web","status":"publish","type":"post","link":"https:\/\/kienthucmo.com\/vi\/session-trong-lap-trinh-web\/","title":{"rendered":"Session trong l\u1eadp tr\u00ecnh web l\u00e0 g\u00ec? C\u00e1ch ho\u1ea1t \u0111\u1ed9ng, \u1ee9ng d\u1ee5ng v\u00e0 b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3"},"content":{"rendered":"\n<p>Khi x\u00e2y d\u1ef1ng \u1ee9ng d\u1ee5ng web, m\u1ed9t trong nh\u1eefng v\u1ea5n \u0111\u1ec1 quan tr\u1ecdng m\u00e0 b\u1ea5t k\u1ef3 l\u1eadp tr\u00ecnh vi\u00ean n\u00e0o c\u0169ng ph\u1ea3i \u0111\u1ed1i m\u1eb7t l\u00e0: <strong>l\u00e0m th\u1ebf n\u00e0o \u0111\u1ec3 l\u01b0u l\u1ea1i tr\u1ea1ng th\u00e1i c\u1ee7a ng\u01b0\u1eddi d\u00f9ng gi\u1eefa c\u00e1c l\u1ea7n g\u1eedi y\u00eau c\u1ea7u (request)?<\/strong> B\u1edfi v\u00ec, v\u1ec1 b\u1ea3n ch\u1ea5t, <strong>HTTP l\u00e0 m\u1ed9t giao th\u1ee9c stateless<\/strong> \u2014 ngh\u0129a l\u00e0 sau m\u1ed7i request, server kh\u00f4ng t\u1ef1 ghi nh\u1edb th\u00f4ng tin g\u00ec v\u1ec1 ng\u01b0\u1eddi d\u00f9ng tr\u01b0\u1edbc \u0111\u00f3.<\/p>\n\n\n\n<p>Ch\u00ednh v\u00ec v\u1eady, <strong>session<\/strong> ra \u0111\u1eddi nh\u01b0 m\u1ed9t gi\u1ea3i ph\u00e1p \u0111\u1ec3 <strong>duy tr\u00ec tr\u1ea1ng th\u00e1i (state)<\/strong> trong qu\u00e1 tr\u00ecnh ng\u01b0\u1eddi d\u00f9ng t\u01b0\u01a1ng t\u00e1c v\u1edbi website. Nh\u1edd session, h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 \u201cnh\u1edb\u201d \u0111\u01b0\u1ee3c ai \u0111ang \u0111\u0103ng nh\u1eadp, h\u1ecd \u0111\u00e3 th\u00eam g\u00ec v\u00e0o gi\u1ecf h\u00e0ng, ho\u1eb7c \u0111ang \u1edf b\u01b0\u1edbc n\u00e0o trong m\u1ed9t form nhi\u1ec1u b\u01b0\u1edbc.<\/p>\n\n\n\n<p>Trong b\u00e0i vi\u1ebft n\u00e0y, m\u00ecnh s\u1ebd c\u00f9ng b\u1ea1n t\u00ecm hi\u1ec3u chi ti\u1ebft v\u1ec1 session \u2014 t\u1eeb <strong>kh\u00e1i ni\u1ec7m, c\u01a1 ch\u1ebf ho\u1ea1t \u0111\u1ed9ng, \u1ee9ng d\u1ee5ng th\u1ef1c t\u1ebf<\/strong>, \u0111\u1ebfn <strong>b\u1ea3o m\u1eadt v\u00e0 so s\u00e1nh v\u1edbi cookie<\/strong>. Hi v\u1ecdng th\u00f4ng qua b\u00e0i vi\u1ebft ch\u00fang ta c\u00f9ng nhau s\u1ebd  hi\u1ec3u r\u00f5 h\u01a1n v\u1ec1 m\u1ed9t ph\u1ea7n quan tr\u1ecdng trong n\u1ec1n t\u1ea3ng c\u1ee7a l\u1eadp tr\u00ecnh web hi\u1ec7n \u0111\u1ea1i.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"301\" src=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-1024x301.png\" alt=\"Session trong l\u1eadp tr\u00ecnh web l\u00e0 g\u00ec? C\u00e1ch ho\u1ea1t \u0111\u1ed9ng, \u1ee9ng d\u1ee5ng v\u00e0 b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3\" class=\"wp-image-2318\" srcset=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-1024x301.png 1024w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-300x88.png 300w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-768x226.png 768w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-1536x451.png 1536w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-1300x382.png 1300w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session.png 1800w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">1. Session l\u00e0 g\u00ec?<\/h2>\n\n\n\n<p><strong>\u0110\u1ecbnh ngh\u0129a:<\/strong><br>Session l\u00e0 m\u1ed9t v\u00f9ng l\u01b0u tr\u1eef t\u1ea1m th\u1eddi \u0111\u01b0\u1ee3c t\u1ea1o ra tr\u00ean <strong>server<\/strong> \u0111\u1ec3 ghi nh\u1edb th\u00f4ng tin v\u1ec1 ng\u01b0\u1eddi d\u00f9ng trong su\u1ed1t qu\u00e1 tr\u00ecnh h\u1ecd t\u01b0\u01a1ng t\u00e1c v\u1edbi \u1ee9ng d\u1ee5ng web. M\u1ed7i session \u0111\u01b0\u1ee3c g\u1eafn v\u1edbi m\u1ed9t <strong>Session ID<\/strong> duy nh\u1ea5t \u2014 gi\u1ed1ng nh\u01b0 \u201ct\u1ea5m v\u00e9 \u0111\u1ecbnh danh\u201d gi\u00fap server bi\u1ebft \u0111\u01b0\u1ee3c ai \u0111ang g\u1eedi y\u00eau c\u1ea7u. B\u00ean trong session c\u00f3 th\u1ec3 ch\u1ee9a c\u00e1c d\u1eef li\u1ec7u nh\u01b0 th\u00f4ng tin \u0111\u0103ng nh\u1eadp, gi\u1ecf h\u00e0ng, ho\u1eb7c c\u00e1c thi\u1ebft l\u1eadp t\u1ea1m th\u1eddi c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n\n\n\n<p><strong>Nh\u1eefng \u0111i\u1ec3m quan tr\u1ecdng c\u1ea7n hi\u1ec3u:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Session kh\u00e1c v\u1edbi cookie:<\/strong> cookie \u0111\u01b0\u1ee3c l\u01b0u tr\u00ean m\u00e1y ng\u01b0\u1eddi d\u00f9ng, c\u00f2n session l\u01b0u tr\u00ean server. Tuy nhi\u00ean, hai c\u01a1 ch\u1ebf n\u00e0y th\u01b0\u1eddng <strong>ph\u1ed1i h\u1ee3p<\/strong> v\u1edbi nhau \u2014 cookie gi\u1eef <code>Session ID<\/code>, c\u00f2n d\u1eef li\u1ec7u th\u1eadt n\u1eb1m tr\u00ean server.<\/li>\n\n\n\n<li><strong>T\u00ednh b\u1ea3o m\u1eadt cao h\u01a1n:<\/strong> v\u00ec th\u00f4ng tin ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng n\u1eb1m tr\u00ean m\u00e1y client, session gi\u00fap h\u1ea1n ch\u1ebf nguy c\u01a1 b\u1ecb s\u1eeda \u0111\u1ed5i ho\u1eb7c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u.<\/li>\n\n\n\n<li><strong>T\u00ednh t\u1ea1m th\u1eddi:<\/strong> session ch\u1ec9 t\u1ed3n t\u1ea1i trong m\u1ed9t kho\u1ea3ng th\u1eddi gian nh\u1ea5t \u0111\u1ecbnh. Khi ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng xu\u1ea5t ho\u1eb7c session h\u1ebft h\u1ea1n, d\u1eef li\u1ec7u trong \u0111\u00f3 s\u1ebd b\u1ecb x\u00f3a.<\/li>\n\n\n\n<li><strong>M\u1ee5c \u0111\u00edch ch\u00ednh:<\/strong> gi\u00fap \u1ee9ng d\u1ee5ng \u201cghi nh\u1edb\u201d tr\u1ea1ng th\u00e1i l\u00e0m vi\u1ec7c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u2014 ch\u1eb3ng h\u1ea1n nh\u01b0 duy tr\u00ec tr\u1ea1ng th\u00e1i \u0111\u0103ng nh\u1eadp, l\u01b0u gi\u1ecf h\u00e0ng, ho\u1eb7c ti\u1ebfp t\u1ee5c c\u00e1c b\u01b0\u1edbc trong m\u1ed9t form nhi\u1ec1u trang.<\/li>\n<\/ul>\n\n\n\n<p>T\u00f3m l\u1ea1i, session \u0111\u00f3ng vai tr\u00f2 l\u00e0 \u201cb\u1ed9 nh\u1edb t\u1ea1m\u201d c\u1ee7a server, gi\u00fap duy tr\u00ec tr\u1ea3i nghi\u1ec7m li\u00ean t\u1ee5c cho ng\u01b0\u1eddi d\u00f9ng tr\u00ean m\u1ed9t giao th\u1ee9c v\u1ed1n kh\u00f4ng c\u00f3 kh\u1ea3 n\u0103ng ghi nh\u1edb nh\u01b0 HTTP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. C\u00e1ch ho\u1ea1t \u0111\u1ed9ng c\u1ee7a session<\/h2>\n\n\n\n<p>\u0110\u1ec3 hi\u1ec3u r\u00f5 c\u01a1 ch\u1ebf ho\u1ea1t \u0111\u1ed9ng c\u1ee7a session, m\u00ecnh c\u00f3 th\u1ec3 h\u00ecnh dung n\u00f3 nh\u01b0 m\u1ed9t qu\u00e1 tr\u00ecnh \u201cghi nh\u1edb c\u00f3 ki\u1ec3m so\u00e1t\u201d gi\u1eefa <strong>client<\/strong> v\u00e0 <strong>server<\/strong>. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 c\u00e1c b\u01b0\u1edbc c\u1ee5 th\u1ec3:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"800\" height=\"379\" src=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/Tai-sao-Session-quan-trong-trong-lap-trinh-web.jpg\" alt=\" C\u00e1ch ho\u1ea1t \u0111\u1ed9ng c\u1ee7a session\" class=\"wp-image-2319\" srcset=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/Tai-sao-Session-quan-trong-trong-lap-trinh-web.jpg 800w, https:\/\/kienthucmo.com\/wp-content\/uploads\/Tai-sao-Session-quan-trong-trong-lap-trinh-web-300x142.jpg 300w, https:\/\/kienthucmo.com\/wp-content\/uploads\/Tai-sao-Session-quan-trong-trong-lap-trinh-web-768x364.jpg 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><figcaption class=\"wp-element-caption\">T\u1ea1i sao Session quan tr\u1ecdng trong l\u1eadp tr\u00ecnh web<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Kh\u1edfi t\u1ea1o session:<\/strong> Khi ng\u01b0\u1eddi d\u00f9ng l\u1ea7n \u0111\u1ea7u g\u1eedi y\u00eau c\u1ea7u (ch\u1eb3ng h\u1ea1n \u0111\u0103ng nh\u1eadp ho\u1eb7c truy c\u1eadp m\u1ed9t trang c\u1ea7n l\u01b0u tr\u1ea1ng th\u00e1i), <strong>server<\/strong> s\u1ebd t\u1ea1o m\u1ed9t <strong>session object<\/strong> m\u1edbi v\u00e0 sinh ra m\u1ed9t <strong>Session ID<\/strong> \u2014 chu\u1ed7i k\u00fd t\u1ef1 ng\u1eabu nhi\u00ean, duy nh\u1ea5t, \u0111\u1ee7 d\u00e0i \u0111\u1ec3 kh\u00f4ng th\u1ec3 \u0111o\u00e1n \u0111\u01b0\u1ee3c.<\/li>\n\n\n\n<li><strong>L\u01b0u d\u1eef li\u1ec7u tr\u00ean server:<\/strong> Server s\u1ebd g\u00e1n c\u00e1c th\u00f4ng tin c\u1ea7n thi\u1ebft (v\u00ed d\u1ee5: <code>user_id<\/code>, vai tr\u00f2 ng\u01b0\u1eddi d\u00f9ng, gi\u1ecf h\u00e0ng t\u1ea1m th\u1eddi, ho\u1eb7c b\u01b0\u1edbc hi\u1ec7n t\u1ea1i trong form) v\u00e0o session object v\u00e0 l\u01b0u trong b\u1ed9 nh\u1edb (RAM), c\u01a1 s\u1edf d\u1eef li\u1ec7u, ho\u1eb7c kho l\u01b0u tr\u1eef chuy\u00ean d\u1ee5ng nh\u01b0 <strong>Redis<\/strong>.<\/li>\n\n\n\n<li><strong>G\u1eedi Session ID v\u1ec1 client:<\/strong> Sau khi t\u1ea1o xong, server g\u1eedi <strong>Session ID<\/strong> n\u00e0y v\u1ec1 client \u2014 th\u00f4ng th\u01b0\u1eddng qua cookie, v\u00ed d\u1ee5: <\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li><\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>Set-Cookie: sessionid=abc123; HttpOnly; Secure<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #D8DEE9FF\">Set<\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Cookie<\/span><span style=\"color: #ECEFF4\">:<\/span><span style=\"color: #D8DEE9FF\"> sessionid<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\">abc123; HttpOnly; Secure<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>&#8211; C\u1edd<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-light-green-cyan-color\">  <\/mark><code><mark style=\"background-color:#8ed1fc\" class=\"has-inline-color has-black-color\"><strong>HttpOnly<\/strong><\/mark><\/code>  v\u00e0 <mark style=\"background-color:#8ed1fc\" class=\"has-inline-color has-black-color\"> <code><strong>Secure<\/strong><\/code><\/mark>  gi\u00fap gi\u1ea3m r\u1ee7i ro t\u1ea5n c\u00f4ng b\u1eb1ng JavaScript ho\u1eb7c qua k\u1ebft n\u1ed1i kh\u00f4ng an to\u00e0n.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Client g\u1eedi l\u1ea1i Session ID:<\/strong><br>Trong c\u00e1c request ti\u1ebfp theo, tr\u00ecnh duy\u1ec7t s\u1ebd <strong>t\u1ef1 \u0111\u1ed9ng \u0111\u00ednh k\u00e8m cookie<\/strong> n\u00e0y trong ph\u1ea7n header. Server nh\u1eadn \u0111\u01b0\u1ee3c Session ID, \u0111\u1ed1i chi\u1ebfu v\u1edbi d\u1eef li\u1ec7u l\u01b0u tr\u1eef, v\u00e0 x\u00e1c \u0111\u1ecbnh \u0111\u01b0\u1ee3c ng\u01b0\u1eddi d\u00f9ng t\u01b0\u01a1ng \u1ee9ng.<\/li>\n\n\n\n<li><strong>X\u1eed l\u00fd logic d\u1ef1a tr\u00ean session:<\/strong> D\u1ef1a v\u00e0o th\u00f4ng tin c\u00f3 trong session, server c\u00f3 th\u1ec3 nh\u1eadn di\u1ec7n ai \u0111ang g\u1eedi y\u00eau c\u1ea7u, h\u1ecd \u0111\u00e3 \u0111\u0103ng nh\u1eadp hay ch\u01b0a, \u0111ang c\u00f3 g\u00ec trong gi\u1ecf h\u00e0ng, v.v&#8230; T\u1eeb \u0111\u00f3 tr\u1ea3 v\u1ec1 k\u1ebft qu\u1ea3 ph\u00f9 h\u1ee3p.<\/li>\n\n\n\n<li><strong>K\u1ebft th\u00fac ho\u1eb7c h\u1ee7y session:<\/strong> Khi ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng xu\u1ea5t, khi session h\u1ebft th\u1eddi gian s\u1ed1ng (timeout), ho\u1eb7c khi server ch\u1ee7 \u0111\u1ed9ng h\u1ee7y, session \u0111\u00f3 s\u1ebd b\u1ecb x\u00f3a kh\u1ecfi b\u1ed9 nh\u1edb.<\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li><\/li>\n<\/ol>\n\n\n\n<p>Session ho\u1ea1t \u0111\u1ed9ng d\u1ef1a v\u00e0o <strong>Session ID<\/strong> \u2013 gi\u1ed1ng nh\u01b0 \u201cch\u00eca kh\u00f3a\u201d gi\u00fap server nh\u1eadn di\u1ec7n ng\u01b0\u1eddi d\u00f9ng. N\u1ebfu Session ID b\u1ecb l\u1ed9, k\u1ebb x\u1ea5u c\u00f3 th\u1ec3 m\u1ea1o danh ng\u01b0\u1eddi d\u00f9ng th\u1eadt (g\u1ecdi l\u00e0 <strong>session hijacking<\/strong>). V\u00ec v\u1eady, vi\u1ec7c b\u1ea3o v\u1ec7 v\u00e0 m\u00e3 h\u00f3a Session ID l\u00e0 m\u1ed9t ph\u1ea7n kh\u00f4ng th\u1ec3 thi\u1ebfu trong b\u1ea3o m\u1eadt web.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. \u1ee8ng d\u1ee5ng c\u1ee7a Session<\/h2>\n\n\n\n<p>Session \u0111\u00f3ng vai tr\u00f2 trung t\u00e2m trong vi\u1ec7c duy tr\u00ec <strong>tr\u1ea1ng th\u00e1i ng\u01b0\u1eddi d\u00f9ng<\/strong> (user state) tr\u00ean m\u00f4i tr\u01b0\u1eddng web v\u1ed1n mang t\u00ednh \u201cstateless\u201d \u2013 t\u1ee9c l\u00e0 m\u1ed7i request \u0111\u1ed9c l\u1eadp v\u1edbi nhau. Nh\u1edd session, server c\u00f3 th\u1ec3 \u201cnh\u1edb\u201d ng\u01b0\u1eddi d\u00f9ng l\u00e0 ai v\u00e0 h\u1ecd \u0111ang l\u00e0m g\u00ec trong su\u1ed1t qu\u00e1 tr\u00ecnh t\u01b0\u01a1ng t\u00e1c. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 nh\u1eefng \u1ee9ng d\u1ee5ng ph\u1ed5 bi\u1ebfn v\u00e0 thi\u1ebft th\u1ef1c c\u1ee7a session trong l\u1eadp tr\u00ecnh web:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Qu\u1ea3n l\u00fd \u0111\u0103ng nh\u1eadp (Authentication):<\/strong><br>Sau khi ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng nh\u1eadp th\u00e0nh c\u00f4ng, server t\u1ea1o session v\u00e0 l\u01b0u l\u1ea1i th\u00f4ng tin \u0111\u1ecbnh danh nh\u01b0 <code>user_id<\/code>, <code>username<\/code> ho\u1eb7c <code>role<\/code>. Nh\u1edd \u0111\u00f3, \u1edf c\u00e1c request ti\u1ebfp theo, server nh\u1eadn bi\u1ebft ng\u01b0\u1eddi d\u00f9ng m\u00e0 kh\u00f4ng c\u1ea7n y\u00eau c\u1ea7u \u0111\u0103ng nh\u1eadp l\u1ea1i li\u00ean t\u1ee5c. \u0110\u00e2y l\u00e0 n\u1ec1n t\u1ea3ng c\u1ee7a m\u1ecdi h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c truy\u1ec1n th\u1ed1ng.<\/li>\n\n\n\n<li><strong>Gi\u1ecf h\u00e0ng (Shopping Cart):<\/strong><br>Trong c\u00e1c trang th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed, session gi\u00fap l\u01b0u tr\u1eef t\u1ea1m danh s\u00e1ch s\u1ea3n ph\u1ea9m m\u00e0 ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 ch\u1ecdn, ngay c\u1ea3 khi h\u1ecd ch\u01b0a \u0111\u0103ng nh\u1eadp ho\u1eb7c ch\u01b0a thanh to\u00e1n. Khi ng\u01b0\u1eddi d\u00f9ng ti\u1ebfp t\u1ee5c mua s\u1eafm, gi\u1ecf h\u00e0ng v\u1eabn \u0111\u01b0\u1ee3c duy tr\u00ec xuy\u00ean su\u1ed1t phi\u00ean l\u00e0m vi\u1ec7c.<\/li>\n\n\n\n<li><strong>Form nhi\u1ec1u b\u01b0\u1edbc (Multi-step Form):<\/strong><br>V\u1edbi c\u00e1c bi\u1ec3u m\u1eabu d\u00e0i ho\u1eb7c quy tr\u00ecnh nhi\u1ec1u b\u01b0\u1edbc (v\u00ed d\u1ee5: \u0111\u0103ng k\u00fd d\u1ecbch v\u1ee5, thanh to\u00e1n nhi\u1ec1u giai \u0111o\u1ea1n), session l\u01b0u t\u1ea1m th\u00f4ng tin t\u1eebng b\u01b0\u1edbc. \u0110i\u1ec1u n\u00e0y gi\u00fap d\u1eef li\u1ec7u kh\u00f4ng b\u1ecb m\u1ea5t khi ng\u01b0\u1eddi d\u00f9ng quay l\u1ea1i b\u01b0\u1edbc tr\u01b0\u1edbc ho\u1eb7c chuy\u1ec3n sang b\u01b0\u1edbc ti\u1ebfp theo.<\/li>\n\n\n\n<li><strong>T\u00f9y ch\u1ec9nh giao di\u1ec7n ng\u01b0\u1eddi d\u00f9ng (User Preferences):<\/strong><br>Session c\u00f3 th\u1ec3 ghi nh\u1edb c\u00e1c t\u00f9y ch\u1ecdn c\u00e1 nh\u00e2n nh\u01b0 ng\u00f4n ng\u1eef hi\u1ec3n th\u1ecb, ch\u1ebf \u0111\u1ed9 s\u00e1ng\/t\u1ed1i (theme), k\u00edch th\u01b0\u1edbc font, ho\u1eb7c b\u1ed1 c\u1ee5c hi\u1ec3n th\u1ecb. \u0110i\u1ec1u n\u00e0y mang l\u1ea1i tr\u1ea3i nghi\u1ec7m \u0111\u1ed3ng nh\u1ea5t trong su\u1ed1t qu\u00e1 tr\u00ecnh truy c\u1eadp.<\/li>\n\n\n\n<li><strong>Gi\u1edbi h\u1ea1n t\u1ea1m th\u1eddi (Temporary Rate Limiting):<\/strong><br>M\u1ed9t s\u1ed1 \u1ee9ng d\u1ee5ng s\u1eed d\u1ee5ng session \u0111\u1ec3 \u0111\u1ebfm s\u1ed1 l\u01b0\u1ee3ng request t\u1eeb ng\u01b0\u1eddi d\u00f9ng trong m\u1ed9t kho\u1ea3ng th\u1eddi gian ng\u1eafn, gi\u00fap ng\u0103n ch\u1eb7n h\u00e0nh vi spam ho\u1eb7c t\u1ea5n c\u00f4ng brute-force m\u00e0 kh\u00f4ng c\u1ea7n can thi\u1ec7p v\u00e0o h\u1ec7 th\u1ed1ng database ch\u00ednh.<\/li>\n<\/ul>\n\n\n\n<p>T\u00f3m l\u1ea1i, session l\u00e0 c\u00f4ng c\u1ee5 <strong>linh ho\u1ea1t v\u00e0 m\u1ea1nh m\u1ebd<\/strong> gi\u00fap c\u00e1c l\u1eadp tr\u00ecnh vi\u00ean x\u1eed l\u00fd nhi\u1ec1u t\u00ecnh hu\u1ed1ng c\u1ea7n \u201cghi nh\u1edb t\u1ea1m th\u1eddi\u201d trong \u1ee9ng d\u1ee5ng web. Nh\u1edd session, tr\u1ea3i nghi\u1ec7m ng\u01b0\u1eddi d\u00f9ng tr\u1edf n\u00ean li\u1ec1n m\u1ea1ch, an to\u00e0n v\u00e0 ti\u1ec7n l\u1ee3i h\u01a1n.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1000\" height=\"456\" src=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-la-gi.jpg\" alt=\"\u1ee8ng d\u1ee5ng c\u1ee7a Session\" class=\"wp-image-2320\" srcset=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-la-gi.jpg 1000w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-la-gi-300x137.jpg 300w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-la-gi-768x350.jpg 768w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">4. Qu\u1ea3n l\u00fd v\u00e0 b\u1ea3o m\u1eadt Session<\/h2>\n\n\n\n<p>Session l\u00e0 n\u01a1i l\u01b0u gi\u1eef th\u00f4ng tin \u0111\u1ecbnh danh c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u2014 nh\u01b0 <code>user_id<\/code>, <code>role<\/code>, ho\u1eb7c tr\u1ea1ng th\u00e1i \u0111\u0103ng nh\u1eadp \u2014 n\u00ean n\u1ebfu b\u1ecb t\u1ea5n c\u00f4ng, k\u1ebb x\u1ea5u c\u00f3 th\u1ec3 chi\u1ebfm quy\u1ec1n truy c\u1eadp t\u00e0i kho\u1ea3n ho\u1eb7c d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m. V\u00ec v\u1eady, vi\u1ec7c qu\u1ea3n l\u00fd v\u00e0 b\u1ea3o m\u1eadt session l\u00e0 y\u1ebfu t\u1ed1 s\u1ed1ng c\u00f2n trong m\u1ecdi \u1ee9ng d\u1ee5ng web.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4.1. C\u00e1c r\u1ee7i ro ph\u1ed5 bi\u1ebfn<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Session hijacking:<\/strong><br>\u0110\u00e2y l\u00e0 h\u00ecnh th\u1ee9c t\u1ea5n c\u00f4ng khi hacker \u0111\u00e1nh c\u1eafp Session ID (qua sniffing, XSS, ho\u1eb7c l\u1eeba ng\u01b0\u1eddi d\u00f9ng nh\u1ea5p v\u00e0o link \u0111\u1ed9c h\u1ea1i) \u0111\u1ec3 m\u1ea1o danh ng\u01b0\u1eddi d\u00f9ng th\u1eadt. M\u1ed9t khi c\u00f3 Session ID h\u1ee3p l\u1ec7, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 truy c\u1eadp v\u00e0o t\u00e0i kho\u1ea3n nh\u01b0 ch\u00ednh ch\u1ee7 nh\u00e2n.<\/li>\n\n\n\n<li><strong>Session fixation:<\/strong><br>Hacker t\u1ea1o s\u1eb5n m\u1ed9t Session ID r\u1ed3i d\u1ee5 ng\u01b0\u1eddi d\u00f9ng s\u1eed d\u1ee5ng n\u00f3 (v\u00ed d\u1ee5 b\u1eb1ng c\u00e1ch g\u1eedi link ch\u1ee9a session ID). Sau khi ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng nh\u1eadp, session v\u1eabn l\u00e0 ID \u0111\u00f3 \u2014 v\u00e0 hacker c\u00f3 th\u1ec3 d\u00f9ng l\u1ea1i \u0111\u1ec3 \u0111\u0103ng nh\u1eadp nh\u01b0 h\u1ecd.<\/li>\n\n\n\n<li><strong>L\u01b0u session thi\u1ebfu an to\u00e0n:<\/strong><br>Vi\u1ec7c l\u01b0u tr\u1ef1c ti\u1ebfp th\u00f4ng tin nh\u1ea1y c\u1ea3m nh\u01b0 m\u1eadt kh\u1ea9u, token API, ho\u1eb7c d\u1eef li\u1ec7u c\u00e1 nh\u00e2n trong session m\u00e0 kh\u00f4ng m\u00e3 h\u00f3a c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn r\u00f2 r\u1ec9 khi h\u1ec7 th\u1ed1ng b\u1ecb x\u00e2m nh\u1eadp.<\/li>\n\n\n\n<li><strong>Th\u1eddi gian s\u1ed1ng kh\u00f4ng \u0111\u01b0\u1ee3c ki\u1ec3m so\u00e1t:<\/strong><br>N\u1ebfu session t\u1ed3n t\u1ea1i qu\u00e1 l\u00e2u ho\u1eb7c kh\u00f4ng h\u1ebft h\u1ea1n khi ng\u01b0\u1eddi d\u00f9ng logout, hacker c\u00f3 th\u1ec3 t\u1eadn d\u1ee5ng session c\u0169 \u0111\u1ec3 truy c\u1eadp tr\u00e1i ph\u00e9p.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4.2. Th\u1ef1c h\u00e0nh b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lu\u00f4n s\u1eed d\u1ee5ng HTTPS:<\/strong><br>M\u00e3 h\u00f3a to\u00e0n b\u1ed9 d\u1eef li\u1ec7u trao \u0111\u1ed5i gi\u1eefa client v\u00e0 server gi\u00fap ng\u0103n ch\u1eb7n vi\u1ec7c nghe l\u00e9n (sniffing) ho\u1eb7c t\u1ea5n c\u00f4ng trung gian (MITM).<\/li>\n\n\n\n<li><strong>\u0110\u00e1nh d\u1ea5u cookie b\u1eb1ng HttpOnly v\u00e0 Secure:<\/strong><br><code>HttpOnly<\/code> ng\u0103n JavaScript truy c\u1eadp v\u00e0o cookie (ch\u1ed1ng XSS), c\u00f2n <code>Secure<\/code> \u0111\u1ea3m b\u1ea3o cookie ch\u1ec9 \u0111\u01b0\u1ee3c g\u1eedi qua k\u1ebft n\u1ed1i HTTPS.<\/li>\n\n\n\n<li><strong>Regenerate Session ID sau khi \u0111\u0103ng nh\u1eadp:<\/strong><br>Sau khi ng\u01b0\u1eddi d\u00f9ng x\u00e1c th\u1ef1c th\u00e0nh c\u00f4ng, server n\u00ean t\u1ea1o m\u1ed9t Session ID m\u1edbi v\u00e0 h\u1ee7y c\u00e1i c\u0169 \u0111\u1ec3 ng\u0103n session fixation.<\/li>\n\n\n\n<li><strong>Thi\u1ebft l\u1eadp th\u1eddi gian s\u1ed1ng h\u1ee3p l\u00fd:<\/strong><br>Th\u00f4ng th\u01b0\u1eddng, session n\u00ean h\u1ebft h\u1ea1n sau 15\u201330 ph\u00fat kh\u00f4ng ho\u1ea1t \u0111\u1ed9ng. N\u1ebfu c\u00f3 t\u00ednh n\u0103ng \u201cRemember me\u201d, h\u00e3y s\u1eed d\u1ee5ng token ri\u00eang bi\u1ec7t v\u00e0 b\u1ea3o v\u1ec7 k\u1ef9 l\u01b0\u1ee1ng.<\/li>\n\n\n\n<li><strong>Kh\u00f4ng l\u01b0u tr\u1ef1c ti\u1ebfp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m:<\/strong><br>Ch\u1ec9 n\u00ean l\u01b0u c\u00e1c ID tham chi\u1ebfu (nh\u01b0 user_id), c\u00f2n d\u1eef li\u1ec7u chi ti\u1ebft truy xu\u1ea5t t\u1eeb database khi c\u1ea7n. N\u1ebfu bu\u1ed9c ph\u1ea3i l\u01b0u, h\u00e3y m\u00e3 h\u00f3a ch\u00fang.<\/li>\n\n\n\n<li><strong>Ki\u1ec3m tra IP ho\u1eb7c User-Agent:<\/strong><br>M\u1ed9t s\u1ed1 h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 so s\u00e1nh IP v\u00e0 User-Agent \u0111\u1ec3 ph\u00e1t hi\u1ec7n h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng. Tuy nhi\u00ean, c\u1ea7n l\u01b0u \u00fd IP c\u00f3 th\u1ec3 thay \u0111\u1ed5i trong m\u1ea1ng di \u0111\u1ed9ng ho\u1eb7c ISP.<\/li>\n\n\n\n<li><strong>S\u1eed d\u1ee5ng kho l\u01b0u tr\u1eef an to\u00e0n:<\/strong><br>N\u00ean l\u01b0u session trong Redis, database c\u00f3 TTL (Time-To-Live), ho\u1eb7c storage \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 quy\u1ec1n truy c\u1eadp. Tuy\u1ec7t \u0111\u1ed1i kh\u00f4ng l\u01b0u trong th\u01b0 m\u1ee5c c\u00f4ng khai.<\/li>\n\n\n\n<li><strong>Gi\u1edbi h\u1ea1n dung l\u01b0\u1ee3ng session:<\/strong><br>Tr\u00e1nh l\u01b0u tr\u1eef d\u1eef li\u1ec7u qu\u00e1 l\u1edbn trong session, v\u1eeba t\u0103ng r\u1ee7i ro b\u1ea3o m\u1eadt, v\u1eeba \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn hi\u1ec7u n\u0103ng h\u1ec7 th\u1ed1ng.<\/li>\n<\/ul>\n\n\n\n<p>T\u00f3m l\u1ea1i, vi\u1ec7c b\u1ea3o m\u1eadt session kh\u00f4ng ch\u1ec9 l\u00e0 b\u1ea3o v\u1ec7 m\u1ed9t chu\u1ed7i ID, m\u00e0 l\u00e0 b\u1ea3o v\u1ec7 <strong>to\u00e0n b\u1ed9 qu\u00e1 tr\u00ecnh x\u00e1c th\u1ef1c v\u00e0 duy tr\u00ec tr\u1ea1ng th\u00e1i ng\u01b0\u1eddi d\u00f9ng<\/strong>. M\u1ed9t h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd session an to\u00e0n s\u1ebd gi\u00fap gi\u1ea3m \u0111\u00e1ng k\u1ec3 nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n, b\u1ea3o v\u1ec7 tr\u1ea3i nghi\u1ec7m ng\u01b0\u1eddi d\u00f9ng v\u00e0 uy t\u00edn c\u1ee7a \u1ee9ng d\u1ee5ng.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"612\" height=\"408\" src=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-quan-trong-nhu-the-nao.jpg\" alt=\" Qu\u1ea3n l\u00fd v\u00e0 b\u1ea3o m\u1eadt Session\" class=\"wp-image-2321\" srcset=\"https:\/\/kienthucmo.com\/wp-content\/uploads\/session-quan-trong-nhu-the-nao.jpg 612w, https:\/\/kienthucmo.com\/wp-content\/uploads\/session-quan-trong-nhu-the-nao-300x200.jpg 300w\" sizes=\"(max-width: 612px) 100vw, 612px\" \/><figcaption class=\"wp-element-caption\">Session<\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">5. Session v\u00e0 Cookie: N\u00ean d\u00f9ng khi n\u00e0o?<\/h2>\n\n\n\n<p>Trong l\u1eadp tr\u00ecnh web, <strong>Session<\/strong> v\u00e0 <strong>Cookie<\/strong> \u0111\u1ec1u gi\u00fap l\u01b0u th\u00f4ng tin v\u1ec1 ng\u01b0\u1eddi d\u00f9ng, nh\u01b0ng ch\u00fang ho\u1ea1t \u0111\u1ed9ng \u1edf <strong>hai c\u1ea5p \u0111\u1ed9 kh\u00e1c nhau<\/strong>: m\u1ed9t b\u00ean \u1edf <strong>server<\/strong>, m\u1ed9t b\u00ean \u1edf <strong>client<\/strong>. \u0110\u1ec3 hi\u1ec3u r\u00f5 h\u01a1n, h\u00e3y xem b\u1ea3ng so s\u00e1nh d\u01b0\u1edbi \u0111\u00e2y:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Ti\u00eau ch\u00ed<\/th><th><strong>Session<\/strong><\/th><th><strong>Cookie<\/strong><\/th><\/tr><\/thead><tbody><tr><td><strong>V\u1ecb tr\u00ed l\u01b0u tr\u1eef<\/strong><\/td><td>L\u01b0u tr\u00ean <strong>server<\/strong><\/td><td>L\u01b0u tr\u00ean <strong>tr\u00ecnh duy\u1ec7t (client)<\/strong><\/td><\/tr><tr><td><strong>Th\u00e0nh ph\u1ea7n ch\u00ednh<\/strong><\/td><td>G\u1ed3m <strong>Session ID<\/strong> v\u00e0 d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng (session data)<\/td><td>D\u1eef li\u1ec7u d\u1ea1ng <strong>key\u2013value<\/strong>, v\u00ed d\u1ee5 <code>theme=dark<\/code><\/td><\/tr><tr><td><strong>C\u00e1ch ho\u1ea1t \u0111\u1ed9ng<\/strong><\/td><td>Server t\u1ea1o Session ID v\u00e0 g\u1eedi v\u1ec1 client (th\u01b0\u1eddng qua cookie). M\u1ed7i request sau \u0111\u00f3 g\u1eedi l\u1ea1i ID \u0111\u1ec3 truy xu\u1ea5t d\u1eef li\u1ec7u tr\u00ean server<\/td><td>Tr\u00ecnh duy\u1ec7t t\u1ef1 \u0111\u1ed9ng g\u1eedi cookie k\u00e8m m\u1ed7i request \u0111\u1ebfn c\u00f9ng domain<\/td><\/tr><tr><td><strong>Th\u1eddi gian t\u1ed3n t\u1ea1i<\/strong><\/td><td>T\u1ea1m th\u1eddi (khi h\u1ebft h\u1ea1n ho\u1eb7c logout th\u00ec m\u1ea5t)<\/td><td>C\u00f3 th\u1ec3 t\u1ea1m th\u1eddi ho\u1eb7c l\u00e2u d\u00e0i n\u1ebfu \u0111\u1eb7t <code>Expires<\/code> \/ <code>Max-Age<\/code><\/td><\/tr><tr><td><strong>B\u1ea3o m\u1eadt<\/strong><\/td><td>Cao h\u01a1n, v\u00ec d\u1eef li\u1ec7u n\u1eb1m tr\u00ean server<\/td><td>Th\u1ea5p h\u01a1n, d\u1ec5 b\u1ecb s\u1eeda ho\u1eb7c \u0111\u1ecdc n\u1ebfu kh\u00f4ng b\u1ea3o v\u1ec7 \u0111\u00fang c\u00e1ch<\/td><\/tr><tr><td><strong>Gi\u1edbi h\u1ea1n dung l\u01b0\u1ee3ng<\/strong><\/td><td>Kh\u00f4ng gi\u1edbi h\u1ea1n r\u00f5 r\u00e0ng (ph\u1ee5 thu\u1ed9c v\u00e0o server)<\/td><td>Kho\u1ea3ng <strong>4KB m\u1ed7i cookie<\/strong><\/td><\/tr><tr><td><strong>V\u00ed d\u1ee5 s\u1eed d\u1ee5ng<\/strong><\/td><td>Qu\u1ea3n l\u00fd \u0111\u0103ng nh\u1eadp, gi\u1ecf h\u00e0ng, form nhi\u1ec1u b\u01b0\u1edbc<\/td><td>L\u01b0u ng\u00f4n ng\u1eef, theme, t\u00f9y ch\u1ecdn ng\u01b0\u1eddi d\u00f9ng<\/td><\/tr><tr><td><strong>R\u1ee7i ro ph\u1ed5 bi\u1ebfn<\/strong><\/td><td>Session hijacking, session fixation<\/td><td>Cookie theft, XSS, ch\u1ec9nh s\u1eeda d\u1eef li\u1ec7u<\/td><\/tr><tr><td><strong>Khi n\u00e0o n\u00ean d\u00f9ng<\/strong><\/td><td>Khi c\u1ea7n l\u01b0u th\u00f4ng tin nh\u1ea1y c\u1ea3m ho\u1eb7c tr\u1ea1ng th\u00e1i phi\u00ean l\u00e0m vi\u1ec7c<\/td><td>Khi l\u01b0u d\u1eef li\u1ec7u nh\u1eb9, kh\u00f4ng quan tr\u1ecdng ho\u1eb7c c\u1ea7n nh\u1edb l\u00e2u h\u01a1n<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Session v\u00e0 Cookie l\u00e0 hai c\u01a1 ch\u1ebf quan tr\u1ecdng gi\u00fap \u1ee9ng d\u1ee5ng web \u201cghi nh\u1edb\u201d ng\u01b0\u1eddi d\u00f9ng trong qu\u00e1 tr\u00ecnh t\u01b0\u01a1ng t\u00e1c, nh\u01b0ng m\u1ed7i b\u00ean c\u00f3 vai tr\u00f2 ri\u00eang bi\u1ec7t:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Session<\/strong> \u0111\u1eb7c bi\u1ec7t ph\u00f9 h\u1ee3p v\u1edbi nh\u1eefng <strong>d\u1eef li\u1ec7u c\u1ea7n b\u1ea3o m\u1eadt ho\u1eb7c g\u1eafn li\u1ec1n v\u1edbi tr\u1ea1ng th\u00e1i phi\u00ean l\u00e0m vi\u1ec7c<\/strong> c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u2014 v\u00ed d\u1ee5 nh\u01b0 th\u00f4ng tin \u0111\u0103ng nh\u1eadp, quy\u1ec1n truy c\u1eadp, ho\u1eb7c d\u1eef li\u1ec7u t\u1ea1m th\u1eddi trong gi\u1ecf h\u00e0ng. V\u00ec d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c l\u01b0u tr\u00ean server, ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng th\u1ec3 can thi\u1ec7p ho\u1eb7c ch\u1ec9nh s\u1eeda, gi\u00fap t\u0103ng \u0111\u1ed9 an to\u00e0n. Ngo\u00e0i ra, session ch\u1ec9 t\u1ed3n t\u1ea1i trong m\u1ed9t kho\u1ea3ng th\u1eddi gian nh\u1ea5t \u0111\u1ecbnh, gi\u00fap gi\u1ea3m nguy c\u01a1 l\u1ed9 th\u00f4ng tin khi ng\u01b0\u1eddi d\u00f9ng r\u1eddi kh\u1ecfi \u1ee9ng d\u1ee5ng.<\/li>\n\n\n\n<li><strong>Cookie<\/strong> l\u1ea1i th\u00edch h\u1ee3p h\u01a1n v\u1edbi nh\u1eefng <strong>th\u00f4ng tin nh\u1eb9, \u00edt nh\u1ea1y c\u1ea3m v\u00e0 c\u1ea7n \u0111\u01b0\u1ee3c l\u01b0u l\u00e2u d\u00e0i<\/strong> nh\u01b0 giao di\u1ec7n \u01b0a th\u00edch (dark\/light), ng\u00f4n ng\u1eef, ho\u1eb7c tr\u1ea1ng th\u00e1i \u201cghi nh\u1edb \u0111\u0103ng nh\u1eadp\u201d. Cookie gi\u00fap tr\u00ecnh duy\u1ec7t t\u1ef1 \u0111\u1ed9ng kh\u00f4i ph\u1ee5c tr\u1ea3i nghi\u1ec7m c\u1ee7a ng\u01b0\u1eddi d\u00f9ng trong c\u00e1c l\u1ea7n truy c\u1eadp sau, t\u1ea1o c\u1ea3m gi\u00e1c li\u1ec1n m\u1ea1ch v\u00e0 ti\u1ec7n l\u1ee3i.<\/li>\n\n\n\n<li><strong>K\u1ebft h\u1ee3p c\u1ea3 hai<\/strong> l\u00e0 c\u00e1ch ti\u1ebfp c\u1eadn ph\u1ed5 bi\u1ebfn nh\u1ea5t trong c\u00e1c \u1ee9ng d\u1ee5ng web hi\u1ec7n nay. Th\u00f4ng th\u01b0\u1eddng, <strong>cookie ch\u1ec9 d\u00f9ng \u0111\u1ec3 l\u01b0u Session ID (ho\u1eb7c token x\u00e1c th\u1ef1c)<\/strong>, c\u00f2n to\u00e0n b\u1ed9 d\u1eef li\u1ec7u th\u1ef1c t\u1ebf \u0111\u01b0\u1ee3c l\u01b0u an to\u00e0n trong session \u1edf ph\u00eda server. C\u00e1ch l\u00e0m n\u00e0y v\u1eeba \u0111\u1ea3m b\u1ea3o t\u00ednh <strong>b\u1ea3o m\u1eadt<\/strong>, v\u1eeba mang l\u1ea1i <strong>tr\u1ea3i nghi\u1ec7m m\u01b0\u1ee3t m\u00e0<\/strong> cho ng\u01b0\u1eddi d\u00f9ng.<\/li>\n<\/ul>\n\n\n\n<p>N\u00f3i ng\u1eafn g\u1ecdn, cookie l\u00e0 \u201cch\u00eca kh\u00f3a\u201d, c\u00f2n session l\u00e0 \u201cc\u00e1nh c\u1eeda\u201d ch\u1ee9a th\u00f4ng tin. Khi ph\u1ed1i h\u1ee3p \u0111\u00fang c\u00e1ch, c\u1ea3 hai t\u1ea1o n\u00ean m\u1ed9t h\u1ec7 th\u1ed1ng web v\u1eeba ti\u1ec7n l\u1ee3i v\u1eeba an to\u00e0n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. K\u1ebft lu\u1eadn<\/h2>\n\n\n\n<p>Session l\u00e0 n\u1ec1n t\u1ea3ng c\u1ed1t l\u00f5i gi\u00fap \u1ee9ng d\u1ee5ng web \u201cghi nh\u1edb\u201d ng\u01b0\u1eddi d\u00f9ng trong su\u1ed1t qu\u00e1 tr\u00ecnh t\u01b0\u01a1ng t\u00e1c, \u0111\u1ea3m b\u1ea3o tr\u1ea3i nghi\u1ec7m m\u01b0\u1ee3t m\u00e0 v\u00e0 li\u1ec1n m\u1ea1ch. Vi\u1ec7c n\u1eafm v\u1eefng c\u01a1 ch\u1ebf ho\u1ea1t \u0111\u1ed9ng c\u1ee7a session, hi\u1ec3u r\u00f5 s\u1ef1 kh\u00e1c bi\u1ec7t so v\u1edbi cookie v\u00e0 \u00e1p d\u1ee5ng c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt h\u1ee3p l\u00fd s\u1ebd gi\u00fap h\u1ec7 th\u1ed1ng v\u1eadn h\u00e0nh \u1ed5n \u0111\u1ecbnh, \u0111\u00e1ng tin c\u1eady h\u01a1n. \u0110\u1ed1i v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng c\u00f3 ch\u1ee9c n\u0103ng \u0111\u0103ng nh\u1eadp, gi\u1ecf h\u00e0ng ho\u1eb7c bi\u1ec3u m\u1eabu nhi\u1ec1u b\u01b0\u1edbc, session \u0111\u00f3ng vai tr\u00f2 nh\u01b0 chi\u1ebfc c\u1ea7u n\u1ed1i duy tr\u00ec tr\u1ea1ng th\u00e1i ng\u01b0\u1eddi d\u00f9ng xuy\u00ean su\u1ed1t. Thi\u1ebft k\u1ebf session \u0111\u00fang ngay t\u1eeb \u0111\u1ea7u kh\u00f4ng ch\u1ec9 gi\u1ea3m thi\u1ec3u r\u1ee7i ro b\u1ea3o m\u1eadt m\u00e0 c\u00f2n t\u1ea1o n\u1ec1n t\u1ea3ng v\u1eefng ch\u1eafc cho vi\u1ec7c m\u1edf r\u1ed9ng, t\u1ed1i \u01b0u v\u00e0 ph\u00e1t tri\u1ec3n l\u00e2u d\u00e0i c\u1ee7a to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng web.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. T\u00e0i li\u1ec7u tham kh\u1ea3o<\/h2>\n\n\n\n<p>[1] D. Gourley, B. Totty, M. Sayer, A. Reddy, and H. Fry, <em>HTTP: The Definitive Guide<\/em>. O&#8217;Reilly Media, 2002.<br>[2] A. Barth, \u201cHTTP State Management Mechanism,\u201d RFC 6265, Internet Engineering Task Force (IETF), Apr. 2011.<br>[3] Mozilla Developer Network, \u201cSessions and State Management in HTTP,\u201d <em>MDN Web Docs<\/em>, 2024.<br>[4] R. Fielding et al., \u201cHypertext Transfer Protocol \u2013 HTTP\/1.1,\u201d RFC 2616, Internet Engineering Task Force (IETF), Jun. 1999.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>session ra \u0111\u1eddi nh\u01b0 m\u1ed9t gi\u1ea3i ph\u00e1p \u0111\u1ec3 duy tr\u00ec tr\u1ea1ng th\u00e1i (state) trong qu\u00e1 tr\u00ecnh ng\u01b0\u1eddi d\u00f9ng t\u01b0\u01a1ng t\u00e1c v\u1edbi website. Nh\u1edd session, h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 \u201cnh\u1edb\u201d \u0111\u01b0\u1ee3c ai \u0111ang \u0111\u0103ng nh\u1eadp, h\u1ecd \u0111\u00e3 th\u00eam g\u00ec v\u00e0o gi\u1ecf h\u00e0ng, ho\u1eb7c \u0111ang \u1edf b\u01b0\u1edbc n\u00e0o trong m\u1ed9t form nhi\u1ec1u b\u01b0\u1edbc.<\/p>\n","protected":false},"author":1,"featured_media":2317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowieHDDA:productID":"","footnotes":""},"categories":[16,20,17],"tags":[],"class_list":["post-2316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cong-nghe-thong-tin","category-an-toan-thong-tin","category-cong-nghe-phan-mem"],"_links":{"self":[{"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/posts\/2316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/comments?post=2316"}],"version-history":[{"count":2,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/posts\/2316\/revisions"}],"predecessor-version":[{"id":2323,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/posts\/2316\/revisions\/2323"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/media\/2317"}],"wp:attachment":[{"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/media?parent=2316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/categories?post=2316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kienthucmo.com\/vi\/wp-json\/wp\/v2\/tags?post=2316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}