What is a session, and how do apps keep you logged in?

Question

Accepted Answer

A session is the app remembering you between requests. After you log in, the server hands your browser a signed cookie or token, and your browser sends it back with every request. HTTP itself has no memory, so without that token every page load would be a stranger arriving.

The important property is revocation. A plain signed token stays valid until it expires, so someone you removed at 10am can keep working until their token runs out. Checking revocation on the server costs a lookup and closes that window, which matters most for staff accounts and anyone whose role can change.

Store the token in an HTTP-only cookie rather than in localStorage. An HTTP-only cookie cannot be read by JavaScript, so a script injected into your page cannot steal it. That single choice removes the most common path from a cross-site scripting bug to a stolen account.

What is a session, and how do apps keep you logged in?

What is the difference between authentication and authorisation?

What are security headers, and which ones matter?

What are database access rules?

Want this built, not just explained?