Cookies vs Sessions

Cookies and sessions are two ways a website remembers a user across requests, since HTTP itself is stateless. A cookie is a small piece of data the server asks the browser to store and send back with every request to that site.

A session keeps the user's data on the server and gives the browser only a session ID, usually in a cookie. Sessions are safer for sensitive data because the browser holds just an identifier, while cookies are limited in size and visible to the user. Cookies used for sessions should be marked HttpOnly, Secure and SameSite.