How is the scope of user data determined in a web application?

The scope of user data visibility in a web application is determined by how and where this data is stored and accessible within the user's session. This is usually implemented using sessions or authentication tokens.

For example, in Java web applications, user data can be stored in an HttpSession object, which is unique for each user and exists on the server during the session:

HttpSession session = request.getSession();
session.setAttribute("userData", userObject);

Thus, the data is only accessible within the specific user's session. The scope can also be limited by access level to the data, for example, through permission checks when querying the database or API.

If data is stored on the client side (e.g., in cookies or localStorage), the scope is limited to the browser and the user, but this is less secure.

In summary, the scope is determined by:

• The data storage mechanism (session, token, cookies)
• The lifetime of this data (session, persistent storage)
• The access context (server, client)
• Security and authorization measures.