Cookies vs Sessions

To keep users “logged in”, web apps maintain state across multiple requests.

HTTP is stateless, so the server needs a way to recognize a returning user.

diagram where the state actually lives mermaid

  flowchart TD
  subgraph "Server-side session (Flask-Session, Django, …)"
    A1["browser cookie: session_id=abc"] --> A2["server looks up abc"]
    A2 --> A3[("session store: Redis / file / db")]
    A3 --> A4["user data"]
  end
  subgraph "Flask default: a signed cookie"
    B1["browser cookie: payload.timestamp.signature"] --> B2["server verifies the signature with SECRET_KEY"]
    B2 --> B3{"signature valid?"}
    B3 -->|yes| B4["trust the payload -- no lookup needed"]
    B3 -->|no| B5["discard the session entirely"]
  end

A true server-side session keeps the data on the server and gives the browser only an ID. Flask's default does neither -- it puts the data itself in a signed cookie, so the client holds it and can read it, but cannot alter it without the SECRET_KEY.

Cookies (client-side)

A cookie is a small key/value pair stored in the browser and sent on every request to the same domain.

Common uses:

• session identifiers
• preferences (theme, language)

Security notes:

• cookies can be stolen if your site is not using HTTPS
• cookies can be modified by the client unless they’re signed/encrypted

Sessions (server-side concept)

A session is a server-side concept:

• store user state on the server
• keep only a session ID in the cookie

But Flask’s default session implementation is a bit different.

Flask’s default sessions are “secure cookies”

Flask stores session data in a cookie signed with SECRET_KEY.

Meaning:

• client can read it
• client cannot modify it without invalidating the signature

So Flask sessions are not “server-side storage” by default.

If you want server-side sessions, you typically use:

• Flask-Session (Redis, filesystem, etc.)

Practical takeaway

For many apps:

• Flask’s default securely-signed cookie sessions are fine

For high-security or large session data:

• use server-side session storage

Authentication (Flask-Login) typically uses:

• session cookie to remember a user id