Sessions, Cookies & State

A locale resolver runs early in each request and takes the first source that yields a supported locale: a URL marker, a stored preference in a cookie or session, the client's language header, then a configured default.

A per-request attribute bag is a mutable key/value map the framework creates when a request arrives and discards when it completes. Earlier stages write entries into it; the handler and later stages read them, so derived values travel without extra parameters.

Flash scope holds a value written on one request and exposed to the next, after which the framework discards it without any delete call. A plain session attribute stays until code removes it, so it would reappear on later pages.

A delete helper erases nothing: it writes the cookie name back already expired. The client drops a stored cookie only when name, domain and path all match, so a deletion using the framework's default scope misses a differently scoped cookie.

Because the request carries no time zone. The language header conveys language and region, not a zone, so formatting falls back to the process default - whatever the host is configured to. A per-request zone must be supplied explicitly.

Through ambient context: the framework binds the values to the current unit of execution, and code inside that unit reads them without a parameter. The usual carriers are per-thread storage, runtime-carried task context, and a resolving accessor.

A body-hash ETag is computed after the response is rendered, so it saves bytes but none of the work behind them. A validator derived from resource version can be read before rendering, letting the handler stop early.

Most frameworks create a session lazily: the identifier, the store entry and the identifier cookie appear only once a handler uses the session, typically on its first write. Eager creation instead gives every anonymous visitor an entry and a cookie.

The key omits everything the body varies on. Keyed by path alone, the first caller's rendered page is stored and replayed to everyone asking for that path. Fix the key, or refuse to cache identity-dependent responses.

A route-level cache-control helper writes response headers: a freshness window, a shared-or-private marker, sometimes a validator. It keeps no copy and skips no work - the handler still runs and the body is still built on every request.

A signed-cookie helper appends a verifier derived from the value and an application secret, so the server detects any edit a client makes. It hides nothing - the value stays readable. A value that fails verification must be treated as absent.

Lookup narrows per key: the bundle for the full language-and-region locale, then the language-only bundle, then the default bundle. Runtime values are inserted through numbered or named placeholders and formatted in the same resolved locale.

The framework tracks whether the request changed the session. Storing, removing or clearing an attribute marks it dirty, and a dirty session is written back through the store's save operation; an untouched one usually is not written at all.

Framework components write them as a side effect - session, request-forgery protection, locale, flash - as do proxies ahead of it. Each carries its own scope and flags, so app-wide defaults and delete helpers miss it, and shared caches stop storing the response.

An offset is a snapshot of one moment's rule. Zone offsets change at daylight-saving transitions and when governments rewrite the rules, so a future commitment must store the local date-time plus the zone identifier, converted to an instant at use.

Request-scoped context is valid only inside the request's window, on the execution unit it was bound to. Chunk producers and completion callbacks run outside that window, so the binding is absent or recycled. Capture values while the handler still holds them.

One untyped namespace shared by every stage invites silent overwrites, wrong-type reads far from the write, and readers that run before their writer. Give each key one owner, a typed or namespaced name, an accessor, and a stated absence contract.

Both symptoms mean a request other than the intended page consumed the entry. Log every flash write, read and sweep with a request identifier, then find which request landed between the write and the page.

Order by how explicit and how durable each signal is: an in-URL locale for public linkable pages, a signed-in user's stored preference for application surfaces, the client's language header only to seed a first visit, and the configured default last.

Admit only responses no per-caller input touched, that are expensive to produce and tolerant of being out of date. Since each instance holds its own copy with no cross-process purge, bound staleness with a short lifetime or version-stamped keys.

Store only what cannot be re-derived and must survive between requests: small, stable, self-contained values. Everything derivable is cheaper to re-fetch, because each attribute costs serialization on every save and couples two deployed versions to one shape.