session_start() does not just lose a paywall purchaser when the browser closes ā it kills page caching for every visitor. Here is the replacement: an HMAC-signed cookie plus a single-use recovery link, and the design decisions behind both. Premise: sessions cannot coexist with page caching When...
Source: [Dev.to](https://dev.to/acs_developer/drop-sessionstart-from-your-paywall-hmac-signed-cookies-and-single-use-recovery-links-mom)