Difference between browser session and Drupal session

Question

After reading this question over here from 2014, I'm left wondering:

Is there any benefit, security concern, or real reason to use Drupal's session manager class over the browser session $_SESSION[key]?

Specifically wondering about the Symfony session API that was mentioned in the above linked question and whether or not that provides any benefits over the way i'm storing and accessing session data.

'The Drupal Way':

$tempstore = \Drupal::service('user.private_tempstore')->get('mymodule_name');
$tempstore->set('my_variable_name', $some_data);

How I'm currently doing it:

$_SESSION['three_minute'] = array();
$_SESSION['three_minute']['utility'] = $form_state->getValue('utility');

Answer 1

What you are describing is not Drupal session vs. Browser session. There's just one session, always managed by Drupal (partially by using Symfony code. But it's still Drupal).

The (private) tempstore is just a custom storage that used to be provided by ctools in 7.x. For anonymous users, it actually requires a session to be present, as it uses the session ID to identify the entries.

The main difference is that session data is always loaded, on every request. While for the tempstore, you control when and what is loaded. If you have data that is small and you need on many/all pages, use the session directly. If you have big objects, consider using a temp store.

Drupal itself uses the tempstore for example to store node objects for the preview feature and views while editing them.