Whenever you log into an application like Instagram, Netflix, or Gmail, the app somehow “remembers” who you are—even after refreshing the page or opening another route.

But how does this actually work?

How does a server know:

• whether a user is logged in

• who the user is

• whether access should be allowed

This is where authentication approaches like:

• sessions

• cookies

• JWT tokens

become important.

These technologies help applications maintain user identity between requests. While they often work together, they solve authentication in very different ways.

Some approaches store data on the server. Others store data on the client. Some are stateful, while others are stateless.

In this article, we’ll understand what sessions, cookies, and JWT tokens are, how they work internally, the difference between stateful and stateless authentication, and when each approach should be used in real-world applications.

What Cookies Are

Cookies are small pieces of data stored inside the user’s browser.

They are commonly used to:

• maintain login state

• store preferences

• track user activity

How Cookies Work

When a user visits a website, the server can send a cookie:

Set-Cookie: user=armaan

The browser stores this cookie automatically.

On future requests, the browser sends it back:

Cookie: user=armaan

Important Idea

Cookies themselves are not authentication systems.

They are simply a storage mechanism used to persist information between requests.

Why Cookies Exist

HTTP is stateless by default.

This means:

Every request is independent

Without cookies, the server would forget users after every request.

Real-World Examples

Cookies are used for:

• login persistence

• shopping carts

• theme preferences

• session IDs

Key Takeaway

Cookies help browsers store small pieces of information that can be sent with future requests.

What Sessions Are

Sessions are a server-side authentication mechanism used to track logged-in users.

Unlike cookies, session data is stored on the server.

How Session Authentication Works

Step 1

User logs in with credentials.

Step 2

Server creates a session:

Session ID → abc123

Step 3

Server stores session data internally:

abc123 → User Information

Step 4

Server sends the session ID to the browser through a cookie.

Step 5

Browser sends the session ID on future requests.

Important Observation

The browser only stores the session ID.

Actual user data remains on the server.

Why Sessions Became Popular

Sessions provide:

• centralized control

• easier logout handling

• server-side user management

Key Takeaway

Sessions store authentication data on the server while the browser stores only a session identifier.

What JWT Tokens Are

JWT stands for:

JSON Web Token

A JWT is a self-contained token that stores user-related information directly inside the token itself.

Unlike sessions, JWT authentication is usually stateless.

JWT Structure

A JWT has three parts:

Header.Payload.Signature

Example:

xxxxx.yyyyy.zzzzz

How JWT Authentication Works

Step 1

User logs in.

Step 2

Server generates JWT token.

Step 3

Token is sent to client.

Step 4

Client stores token:

• localStorage

• cookies

• memory

Step 5

Client sends token with future requests.

Important Difference

Unlike sessions:

JWT stores user information inside token itself

The server often does not need to store session state.

Key Takeaway

JWT tokens allow stateless authentication by carrying user identity information inside the token itself.

Stateful vs Stateless Authentication

One of the biggest differences between sessions and JWT is:

Stateful vs Stateless

Stateful Authentication

Session-based authentication is stateful.

This means:

Server stores authentication state

The server remembers users through stored sessions.

Stateless Authentication

JWT-based authentication is stateless.

This means:

Server does not store session state

Each request contains all required authentication information inside the token.

Simple Comparison

Why This Matters

Stateless systems scale better because servers don’t need to maintain session memory for every user.

Key Takeaway

Stateful authentication depends on server memory, while stateless authentication carries authentication data with each request.

Session-Based Authentication vs JWT

Both approaches solve authentication, but they work very differently.

Comparison Table

Session Flow

Browser
   │
Sends Session ID
   │
   ▼
Server checks stored session

JWT Flow

Browser
   │
Sends JWT Token
   │
   ▼
Server verifies token signature

Real Difference

Sessions:

Server remembers user

JWT:

Client carries identity

Key Takeaway

Sessions provide centralized control, while JWT provides scalability and flexibility for modern APIs.

When to Use Each Method

There is no universally “best” authentication method.

The right choice depends on the application architecture and requirements.

Use Sessions When

• building traditional web applications

• server-side rendering is used

• centralized control is important

• logout handling must be simple

Examples:

• admin dashboards

• monolithic applications

Use JWT When

• building APIs

• mobile applications

• microservices

• distributed systems

Examples:

• React frontend + Node backend

• mobile apps

• REST APIs

Use Cookies When

Cookies are generally used as storage/transport mechanisms for:

• session IDs

• JWT tokens

• user preferences

Important Real-World Insight

JWT and cookies are not competitors.

JWT tokens themselves are often stored inside cookies.

Key Takeaway

Authentication decisions should depend on scalability, architecture, and application requirements—not trends alone.

Understanding Authentication Approaches Visually

Cookie Flow

Server
  │
Sends Cookie
  │
  ▼
Browser Stores Cookie
  │
  ▼
Cookie Sent with Future Requests

Session Authentication Flow

User Logs In
      │
      ▼
Server Creates Session
      │
      ▼
Session ID Generated
      │
      ▼
Session ID Stored in Cookie
      │
      ▼
Browser Sends Session ID
      │
      ▼
Server Finds Matching Session

JWT Authentication Flow

User Logs In
      │
      ▼
Server Generates JWT
      │
      ▼
JWT Sent to Client
      │
      ▼
Client Stores Token
      │
      ▼
JWT Sent with Requests
      │
      ▼
Server Verifies Signature

Stateful vs Stateless

Stateful Authentication
│
├── Server stores user state
├── Sessions required
└── Server remembers user


Stateless Authentication
│
├── No session storage
├── Client carries token
└── Each request self-contained

Session vs JWT Comparison

Sessions
│
├── simpler logout
├── server-controlled
└── stateful


JWT
│
├── scalable
├── API friendly
└── stateless

Real-World Architecture Thinking

Traditional Website
        │
        ▼
Sessions + Cookies


Modern APIs / Mobile Apps
        │
        ▼
JWT Authentication

Core Mental Model

Sessions
   │
   ▼
Server stores identity


JWT
   │
   ▼
Client carries identity

Key Insight

Authentication is fundamentally about maintaining user identity between requests.

Sessions achieve this through server-side storage, while JWT achieves it through self-contained tokens carried by the client.

Conclusion

Authentication is a critical part of modern web applications, and understanding sessions, cookies, and JWT tokens is essential for backend development.

Cookies provide storage inside the browser, sessions enable server-side authentication state, and JWT tokens allow stateless authentication for scalable systems.

Each approach has its own strengths and trade-offs. Sessions offer simplicity and centralized control, while JWT provides flexibility and scalability for modern APIs and distributed applications.

Choosing the right authentication method depends on the needs of the application, the architecture being used, and how authentication state should be managed.