Lesson 3 of 6 · About 6 minutes
Cookies, sessions, and staying signed in
Learn the concept.
You usually do not type a password for every page. Many applications use a session identifier so later requests can be associated with an authenticated session.
After the first sign-in
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Send the identifier
The browser includes a matching cookie on a later request. This is a simplified session example.
- Validate the session
The server checks that the session is recognized and has not expired or been revoked.
- Check the requested access
A valid session still needs authorization for the requested operation and resource.
- Return the outcome
The server returns permitted content or refuses the request. Possessing cookie text alone is not enough.
Same cookie text. Different session state.
Fictional requests to /api/me.
- Active session
Server recognizes demo-lee and returns the permitted profile.
- Revoked session
Server rejects demo-lee even if the browser still sends it.
Read the visualA request includes a cookie for a session the server has revoked. What should happen?
The server must check whether the session is still valid. Revocation changes the server’s acceptance of that session.
Follow the identifier
A server can set a session cookie. The browser sends matching cookies on later requests under the cookie rules. The service validates the session; a cookie’s presence alone does not make it valid.
Protect the session
A session identifier can be sensitive. Secure limits cookie transmission to secure connections; HttpOnly prevents access through document.cookie; SameSite helps constrain cross-site sending. These controls have different jobs and do not replace other defenses.
Check both ends of sign-out
A cookie can outlast the server-side session it refers to. Expired or revoked sessions must be rejected. Ending a session does not erase files already downloaded.
Put it in context
The lab’s session demo-lee is first active, then revoked. Both requests can carry the same fictional cookie text, but only the active session is accepted. No real sign-in or cookie is created by the exercise.
Make a decision.
Explore the practice space, then answer the check-in below. A correct answer lets you save this lesson to your progress.
YOUR PRACTICE SPACE
Try the idea for yourself.
Enable JavaScript to explore this fictional exercise. The explanation and visual above remain available.
Take this with you.
Staying signed in depends on a valid session, not simply on possessing some cookie text.
Next lesson: How applications communicate through APIs