Working With Session Data in Laravel

Laravel's session facade covers storing per-user, per-visit data across requests — put(), get(), flash(), and forget() together handle most real session needs, with flash() serving a genuinely specific purpose worth understanding separately from the rest.

Storing a value

$request->session()->put('cart_id', $cart->id);
// or, using the global helper
session(['cart_id' => $cart->id]);

Retrieving a value

$cartId = $request->session()->get('cart_id');
$cartId = session('cart_id');

// with a default if the key doesn't exist
$theme = session('theme', 'light');

Checking if a key exists

if ($request->session()->has('cart_id')) {
    // key exists AND is not null
}

if ($request->session()->exists('cart_id')) {
    // key exists, even if its value is null
}

has() and exists() differ specifically on a key whose stored value is null — has() returns false in that case, while exists() returns true, since the key itself is genuinely present in the session regardless of its value.

Removing a value

$request->session()->forget('cart_id');
$request->session()->flush(); // removes everything from the session

Flash data: surviving exactly one subsequent request

$request->session()->flash('success', 'Your order has been placed!');
return redirect('/dashboard');

{{-- in the view rendered by the NEXT request --}}
@if (session('success'))
    
{{ session('success') }}
@endif

flash() is specifically designed for exactly this pattern — a value that needs to survive one redirect (like the post-form-submission redirect-then-show-success-message flow) and then automatically disappears on the request after that, without needing to manually call forget() yourself.

Keeping flash data for one additional request

$request->session()->reflash(); // keeps ALL flash data for one more request
$request->session()->keep(['success']); // keeps only specific keys

Useful for a multi-step redirect chain where the flash message needs to survive more than a single hop — without reflash() or keep(), flash data set before the first redirect would already be gone by the second one.

Incrementing and decrementing a numeric session value

$request->session()->increment('page_views');
$request->session()->decrement('remaining_attempts');

Regenerating the session ID

$request->session()->regenerate();

Regenerating the session ID after a login is a standard security practice — it prevents session fixation, where an attacker who somehow obtained a session ID before authentication could otherwise continue using that same ID to hijack the now-authenticated session.

Choosing a session driver

// .env
SESSION_DRIVER=database
// or: file, cookie, redis, array (array is for testing only, non-persistent)

The file driver (Laravel's default) works fine for a single-server setup — for an application running across multiple servers behind a load balancer, a shared driver like database or redis is necessary, since file-based sessions stored on one server's local disk wouldn't be visible to a different server handling a later request from that same user.