Session & Cookies

OcaltQL manages server-side state with SESSION and client-side state with COOKIE. Sessions are started explicitly and destroyed with KILL SESSION. Cookies support expiry, domain, path, and security flags.

SESSION

Sessions must be started with START SESSION before any session data can be read or written. Session data is accessed and modified through the !SESSION global accessor.

Start a Session
START SESSION
Set Session Data — OF Form
SET "key" AS "value" OF !SESSION
Set Session Data — Typed Verb Target Form
STRING "value" SET !SESSION('key')
Set Session Data — Generic SET Target Form
SET !SESSION('key') AS ?value
Read Session Data
(* () notation *)
EMIT !SESSION('key')

(* OF chain *)
EMIT "key" OF !SESSION
Destroy Entire Session
KILL SESSION

COOKIE

COOKIE SET writes a cookie to the client. COOKIE GET reads a cookie by name into a variable — returns null if the cookie does not exist. COOKIE REMOVE deletes a cookie. All modifiers are optional.

Set a Cookie
COOKIE SET "session" AS ?token
AFTER COOKIE SET "pref" AS "dark" PATH "/"
AFTER COOKIE SET "remember" AS "yes" EXPIRES 7 DAYS
AFTER COOKIE SET "track" AS "x" DOMAIN ".example.com"
AFTER COOKIE SET "auth" AS ?hash SECURE HTTPONLY
Get a Cookie
COOKIE GET "session" SET ?sess
AFTER EMIT ?sess
Get a Cookie — Not Found
COOKIE GET "missing" SET ?nogood
AFTER EMIT ?nogood
(* Output: null *)
Remove a Cookie
COOKIE REMOVE "session"
AFTER COOKIE REMOVE "pref" PATH "/"
SESSION data lives on the server. COOKIE data lives on the client. Use sessions for sensitive data. Use cookies for lightweight persistence and client identification. Never store raw passwords or unencrypted tokens in either.

Session implementation details:
  • Sessions are held in your own namespace, in the reserved /root/.ql area described on Namespace Storage. There is no cap on how many you may hold concurrently.
  • Each session has a 24-hour sliding TTL: it is refreshed every time any session data is read or written. A session with no traffic for 24 hours is dropped automatically.
  • The session ID is transported in an HttpOnly cookie named OQLSESSID. The script never sees or manages it — START SESSION sets the cookie, and subsequent requests carry it automatically.
A real boundary. The standard credentialed API (identity/password + q=) carries no GET, POST, or request data at all — it is a raw script execution with no HTTP context behind it. Only Site Mode forwards a real visitor’s actual request — path, query string, POST body, and cookies — into the executing script.
Crypto & Compute →