Backend & systems·Security and identity
you give the browser an opaque id and keep the actual session state on the server, so logging someone out is one delete.
Session cookie
Also calledserver-side session, session id
An identifier referencing server-held session state. Revocation is immediate and the client learns nothing, which is exactly what stateless tokens give up. The cost is a lookup per request and shared session storage across instances; the flags — `HttpOnly`, `Secure`, `SameSite` — are what make it safe in a browser.