Nevermind session management. The real question is: Why does the publicly accessible booking website have access to the passenger manifest of the aircraft at all?
In what possible way could knowing who the other people on the flight are benefit an individual booking a seat?
This is sloppy, sloppy coding; probably a result of some poor schmuck pulling an all nigher or two because the somebody promised an unrealistic deadline.
Here's my guess: it's probably because you can have multiple people on one reservation. Each passenger on the flight gets an ID, and each reservation contains the IDs of the involved parties. Invalid reservation ID? List all the passengers, obviously!
Well, you need a list of seats occupied by all other passengers so that you can pick yours. The names probably happened to be in the same data set (and yes, of course it's sloppy coding).
The "seat" object though is not connected to knowing "who" is in that seat, only that it is full.
As in "if seat.isoccupied()"
At no time should the passenger object be visible to perform a new booking. I see where you might need it if you are changing a reservation, but again this shouldn't in any way be linked to the passenger manifest.
Maybe they want to be able to verify, across multiple sessions, that multiple seats aren't occupied by the same person, or to potentially be able to visually indicate that someone has multiple seats.
Obviously you can easily design a schema that does that without including the names of other passengers, but that schema would be idiosyncratic to that one purpose.
Given a certain level with the airline, United for example blocks the seat right next to you to offer you extra space (this can be overruled if the plane gets too packed). Thus, one passenger may be linked to more than one seat.
In what possible way could knowing who the other people on the flight are benefit an individual booking a seat?
This is sloppy, sloppy coding; probably a result of some poor schmuck pulling an all nigher or two because the somebody promised an unrealistic deadline.