Sessions

Summary

A server-side mechanism for remembering a user across multiple requests, typically identified by a session ID stored in a cookie. The server maintains session state while the browser normally carries only an identifier, making session lifecycle, expiration, rotation, and invalidation important parts of secure authentication.

• 1Learn how a typical login flow creates and validates a session. Focus on understanding the underlying reason it works, not only memorizing the definition.
• 2Compare session-based auth with token-based (JWT) auth. Write down when you would choose each option and what trade-off drives that choice.
• 3Understand what happens to a session when a user logs out.