State Management on the Web: Cookies and Sessions

During your internet surfing, the websites have to recognize you between the different visits.
Imagine entering your beloved coffee house-the barista has already prepared your regular without you having to say anything. The sites try to provide a similar hassle-free service and their tools for that are cookies and sessions.
Even though these terms sound technical, the idea behind them is simple:
they help websites remember information about you.

What Are Cookies?

Cookies are small text files stored directly on your computer by your web browser.
You can think of them as sticky notes that your browser keeps in a drawer. Each time you revisit a website, your browser shows that sticky note back to the site.

Cookies usually store non-sensitive information that helps improve user experience.

Key Characteristics of Cookies

• Stored on your device (client-side)
• Can survive browser closure
• May last days, weeks, or even years
• Size is limited (about 4KB)
• Can be accessed by JavaScript (unless protected)

Common Uses of Cookies

• Remembering login status
• Keeping items in a shopping cart
• Saving language or theme preferences
• Tracking user behavior for analytics

Cookies are great for long-term memory, but because they live on the user’s device, they are less secure for sensitive data.

What Are Sessions?

Sessions take a different approach. Instead of storing data on your computer, sessions keep information on the website’s server.

When you visit a site, it creates a unique session ID – similar to a claim ticket at a coat check. Your browser holds the ticket, but the actual coat (your data) stays safely on the server.

Key Characteristics of Sessions

• Stored on the server (server-side)
• Usually expire when you close the browser or after inactivity
• Can store larger amounts of data
• More secure for sensitive information
• The session ID is typically sent to the browser as a cookie

Sessions are commonly used for things like:

• User authentication
• Role-based access (admin vs user)
• Temporary user actions during a visit

The Key Difference

The fundamental difference between cookies and sessions is where the data is stored:

• Cookies → stored on the user’s device
• Sessions → stored on the server

Because of this:

• Cookies are best for remembering preferences over long periods
• Sessions are better for secure, temporary states like logged-in users

How Modern Websites Use Both

Most modern websites don’t choose between cookies or sessions—they use both together.

Here’s how it usually works:

• A cookie stores a session ID in the browser
• The session on the server stores sensitive user data

This combination provides:

• Convenience (user stays logged in)
• Security (sensitive data never reaches the browser)