Session vs Cookie, what's the difference?

Question

I have a question about Sessions and Cookies on Node regarding where they are stored and how they work.

To begin with, I understand the following to be true:

1. With a cookie, it is possible to specify how long it will store your data;
2. A session saves data while the browser is open;
3. Cookies are on the client side;
4. Session is on server side;

Then the following questions arise:

1. How does the browser and/or the server know that the user has already logged in and does not need to log in again?
2. If the Session stays inside a cookie what's the difference?
3. Where are cookies stored? In the web browser?

I use the (Blackberry?) passport (browser?) but it does everything by itself. I want to better understand how it works behind the scenes.

My affirmations can be wrong. You can correct me, but please explain to me.

Answer 1

First off, some general facts.

A cookie is stored in the browser and then sent back to the target server with every request to that server.

A cookie can either contain actual state data (such as backgroundColor=blue) or it can just contain a token that only means something to the server.

Whoever sets a cookie decides how long they want it to last before it "expires". If the server sets the cookie (as cookies can also be set from within Javascript in the web page), then the server decides how long they want the cookie to last.

A server session consists of the server creating a unique token and putting that in a cookie that it sets for that browser. In parallel, it also creates a session object that is stored on the server and it creates a means of associating the token with a particular session object such that when a request comes in and it has a particular token in it, the server can find the corresponding session object.

Note, sessions don't have to use cookies. They can also put a session id in the URL itself and that is occasionally used, but isn't very popular for a variety of reasons.

How does browse and / or server know that the user has already logged in and does not need to log in again?

A server can consider a browser to be already logged in if it finds an appropriate cookie in the incoming request and if it finds an associated session object in the server-side session store and if that session object is both logged in and not expired.

If the Session stays inside the cookie why is this difference?

Usually, when using server-side sessions, all that's in the cookie is a unique token - not any of the actual session data.

Where is the cookie stored? In our browser?

Yes, it's stored on your hard drive by the browser and then sent as an http header along with every request to the server that the cookie is associated with.

Answer 2

Regarding what you understand to be true:

1. Yes, when setting a cookie, you can specify how long it will persist. In the article HTTP Cookies in Node.js, see the section entitled "Adding Cookie with expiration Time".
2. Yes, data can be stored in a session if it is explicitly placed there by application code. Your server software may also use it to store other information. Here is a nice short YouTube video on node.js sessions.
3. Cookies are stored in a file on your computer which is managed by your web
   browser, so again, correct. Here's a nice article that explains in more detail: Cookies - Information that websites store on your computer.

As to your other questions:

How does the browser and/or the server know that the user has already logged in and does not need to log in again?

It generally knows this by storing a cookie in your browser whose value is some sort of session ID that acts as an authentication token. When you are successfully authenticated, it will store a cookie and send this cookie's value as an HTTP header or as part of the URL string, etc. each time you make a request to the server. This token is stored on the server with some sort of expiration time, usually something like 15-60 minutes. The expiration timer is reset to zero with each successful request. If session timeout is 30 minutes for example, the token will be invalid after no request is made within 30 minutes. Therefore, if you walk away from your computer for an hour and try to access another page, you will likely be told you need to log in again.

If the Session stays inside a cookie what's the difference?

As I stated in the answer to the previous question, an authentication token is generally stored as a cookie and sent with each request. It's good to use over and over until the session times out.

So, the difference is: A session is stored on the server. A cookie is stored as a file on your computer by your browser. A session cookie is stored on your computer which is used by the server to track individual user sessions.

Where are cookies stored? In the web browser?

Yes, as stated above, cookies are stored in a file on your computer which is managed by your web browser. See the article I linked to above for more detail.