Glossary

Session

A session is a mechanism for persisting state between HTTP requests on the server side. The server stores session data (user_id, cart, flash messages) while the client receives only a session identifier — typically in a cookie.

How it works

On the first request, the server creates a session_id, stores the session data, and sends the session_id in a cookie. Every subsequent request contains that cookie — the server finds the data and "recognises" the user.

Where data is stored

Filesystem — simple, but does not scale across multiple servers
Database — centralised, but adds latency to every request
Redis / Memcached — the most common production choice. Fast and scalable

Session vs JWT

A session is server-side state; JWT is client-side state (in the token). A session can be invalidated instantly; a JWT can only expire naturally or via a blacklist. Sessions suit traditional web apps; JWT suits stateless APIs and microservices.