Session
also: server-side session
Server-side state that remembers a logged-in user across requests, keyed by an ID stored in a cookie.
A session is server-side state that persists a user’s identity and data across the many stateless HTTP requests of a visit. The server creates a session (with a random session ID), stores it (in memory, Redis, or a database), and sends the ID to the browser in a cookie, which the browser returns on each request.
Worked example: after login, the server stores {userId: 42} under session ID abc123 and sets a cookie; each later request sends abc123, so the server looks up the session and knows it is user 42 — without re-authenticating. Gotcha: server-side sessions do not scale trivially — a session in one server’s memory is lost on failover or when a load balancer routes elsewhere, forcing sticky sessions or a shared session store (Redis); stateless token auth (JWT) avoids the store but trades away easy revocation.