A session is the state an application attaches across an otherwise stateless series of HTTP requests, identified by a session id carried in a cookie. The state can be stored server-side or client-side.
Server-Side Session
Server-side session (e.g. PHP)
The application stores the session state in a server file (e.g. /var/lib/php/sessions/sess_<id>) keyed by the cookie value, which is an opaque random id.
session_start();$_SESSION['name'] = $_GET['name']; // state lives on the server
The cookie PHPSESSID carries only the id; the data never leaves the server.
Client-Side Session
Client-side session (e.g. Flask)
The application serialises the state, signs it with a server-held secret key, and stores the whole blob in the cookie.
app.secret_key = 'afDlNaKCtpexin0DTC'session['name'] = username # serialised into the cookie
An example cookie value eyJuYW1lIjoibWFyY28ifQ.Zi4y0g.SEit… is base64(session) . timestamp . HMAC. The user can read the content (no confidentiality) but cannot forge a valid blob without secret_key (integrity). This resembles a signed JSON Web Token (JWT) in shape but is not one.
Attacks at the Cookie Layer
Warning
Either model is only as safe as the cookie it rides on: a forged or swapped session id — as in fixation or tossing — moves the attack to the cookie layer regardless of where the state lives.