Conceptually, “session variables” are a pool of persistent information that is stored on the host, in such a way that they can be quickly retrieved and updated with each incoming request.

The session information is located using some kind of random identifier, customarily stored as a “cookie,” or as a hidden form-field, or as a part of the URL information, or some combination of the foregoing.

Customarily, these mechanisms are used only to transport a random identifier, which is not ”trusted” but rather is subjected to rigorous validation. The client-side is never trusted as a source of original information.

As you peruse the various session-handling modules on CPAN, you will observe how they typically separate the various concerns ... session identification, the transport of the session-identifier between client and host, and session storage. This will give you the flexibility to configure exactly what is needed for your particular application, and to change it in the future if necessary.

I, too, would judge that you have not yet taken the time to avail yourself of the introductory materials to which you, have at several times, thus far been pointed . . . Take care not to waste our time, nor your own!