Editing HTTP (section)

== HTTP application session {{anchor|HTTP session}} ==
HTTP is a [[stateless protocol]]. A stateless protocol does not require the web server to retain information or status about each user for the duration of multiple requests.

Some [[web application]]s need to manage user sessions, so they implement states, or [[Session (computer science)|server side sessions]], using for instance [[HTTP cookie]]s<ref>{{Cite journal |last1=Lee |first1=Wei-Bin |last2=Chen |first2=Hsing-Bai |last3=Chang |first3=Shun-Shyan |last4=Chen |first4=Tzung-Her |date=2019-01-25 |title=Secure and efficient protection for HTTP cookies with self-verification |url=https://onlinelibrary.wiley.com/doi/10.1002/dac.3857 |journal=International Journal of Communication Systems |language=en |volume=32 |issue=2 |pages=e3857 |doi=10.1002/dac.3857|s2cid=59524143 }}</ref> or hidden [[variable (computer science)|variable]]s within [[Form (web)|web form]]s.

To start an application user session, an interactive [[authentication]] via web application [[login]] must be performed. To stop a user session a [[logout]] operation must be requested by user.  These kind of operations do not use [[#HTTP authentication|HTTP authentication]] but a custom managed web application authentication.