Because the HTTP protocol is stateless, web applications require Sessions to persist user information (such as authenticated user identities, shopping cart items, and navigation history) across multiple consecutive requests. Laravel provides a clean, unified session API that works identically regardless of whether your backend storage driver is flat files, MySQL, Memcached, or a distributed Redis cluster.
Session configuration is managed via config/session.php and environment variables:
| Driver (SESSION_DRIVER) | Storage Medium | Best Used For |
|---|---|---|
file (Default) |
storage/framework/sessions/ |
Local development and single-server apps |
cookie |
Encrypted client browser cookies | Small, serverless applications with light session payloads |
database |
MySQL / PostgreSQL sessions table | Easy inspection and multi-server setups without Redis |
redis |
In-memory Redis server | High-concurrency enterprise apps with sub-millisecond lookups |
You can manipulate session data using the session() global helper or the $request->session() instance:
use Illuminate\Http\Request;
public function manageCart(Request $request)
{
// 1. Store a value in session
$request->session()->put('preferred_currency', 'INR');
session(['theme' => 'dark']);
// 2. Retrieve session value (with optional default fallback)
$currency = session('preferred_currency', 'USD');
// 3. Pushing items onto an array stored in session
$request->session()->push('cart.items', [
'id' => 101,
'name' => 'Laravel Master Class Video Course',
'price' => 1499
]);
// 4. Checking existence
if (session()->has('cart.items')) {
// Exists and is not null
}
// 5. Deleting session items
session()->forget('preferred_currency');
// 6. Regenerate session ID (Prevents session fixation attacks)
$request->session()->regenerate();
}
Flash messages are stored in the session exclusively for the next incoming request and then automatically garbage collected. This is the standard mechanism for showing success banners after form submissions:
// Flashing in controller:
public function store(Request $request)
{
// Save record...
return redirect()->route('dashboard')
->with('success', 'Your project has been created successfully!');
}
// Displaying flash messages in Blade layout:
@if (session('success'))
<div class="alert alert-success" style="background:#f0fdf4; border-left:4px solid #16a34a; padding:14px; margin-bottom:20px;">
<i class="fa fa-check-circle" style="color:#16a34a;"></i> {{ session('success') }}
</div>
@endif
Whenever a user logs in, logs out, or changes privilege levels, always execute $request->session()->regenerate() or $request->session()->invalidate(). This destroys the previous session token and issues a brand-new cryptographic token, stopping Session Fixation attacks.
Broaden your backend architecture, REST API design, and enterprise production engineering expertise:
Explore how Laravel authenticates users by persisting user IDs in session stores.
Chain ->with('success', 'Saved!') to pass flash alerts to redirected views.
Scale stateful sessions across multiple server clusters with Redis drivers.
Display validation errors flashed automatically into the session error bag.