What is a session and a cookie

A forgetful server, a login that should drop

Once an HTTP server has handled a request, it forgets us completely. So when the next request comes, it treats us like a first-time guest again.
That raises a strange question. You logged in only once, so why does the login hold as you move from page to page? If the server really forgot every time, you would have to type your username and password again for every page you opened.

Press the visit button. The forgetful server forgets each time, so the login drops on every visit and you have to log in again.

As you can see, this is far too inconvenient. Logging in every time you open a page would wear anyone out fast.
Yet the server cannot be asked to memorize every guest's face either. Requests have no faces, and the guests are countless. So a trick is used: instead of the server memorizing, it hands each guest a small ticket.

The server issues a small pass

When a guest first arrives, the server sends a small ticket along with its response. This ticket is called a cookie, and the browser receives it and keeps it. A number is written on the ticket, something like "you are guest number 7."
Think of the wristband you get at the gate of an amusement park. Real numbers are made of long, random characters so that no one can guess them. The server only has to pair this number with the guest's information, so it never needs to memorize countless guests by face.

Press the issue button. The server hands the guest a small pass (cookie) with a number on it.

Now the guest holds a pass with a number on it. On its side, the server writes that number into its list, linked to this guest. Information such as what is in the cart and whether the guest is logged in goes on the same line.
The key point is that the guest carries the pass. The server does not memorize everything; the guest keeps their own number. So when should the pass be taken out and shown again?

Showing the pass with every request

The browser stores the pass it received and, each time it sends a request to the same site, holds it out automatically, as if saying, "I am guest number 7." The person using the browser does not have to do anything.
It is like writing the number in the corner of every request slip, so the server can tell at a glance who sent a request. A pass also has an expiry date, and once that date has passed, the browser stops showing it.

Press the visit button. The guest holds out the pass number along with the request, every time.

Now the guest sends the same number with every request. From the server's side, a number comes along each time a request arrives.
The server still cannot memorize the guest, but since the number rides with the request, that is no problem. So what does the server do with the number? It only has to match it against the list it wrote down.

Ah, that person!

When the pass number arrives, the server opens the list it kept and looks up "who was number 7 again?" Finding 7 on the list, it recognizes you: "Ah, that person!" The cart and the login state are still there on that line.
Remembering across many requests that you are the same guest like this is called a session. Thanks to the session, the login holds as you move from page to page. When you press log out, the server deletes that line from its list, and the pass becomes useless.

Tap the arriving pass number. The server finds it on the list, says "Ah, that person!", and keeps the login going.

It was a forgetful server, yet now it recognizes us with ease. The secret is not that the server memorized anything, but that the guest carried a pass. The server only has to match numbers against its list, so it handles any number of guests lightly.
But there is one thing to be careful about. Anyone with the right number gets through as that guest. What happens if someone along the way peeks at or steals another person's pass number?

Summary

In short: HTTP does not remember past requests, so it treats us like a first-time guest every time. So the server gives a new guest a small pass with a number on it: a cookie.
The browser sends that pass with every request, and the server matches the number against its list and says, "Ah, that person!" Remembering like this that it is the same guest is the session. The remembering is left to the guest's pass, and the server only matches the number.

Tap the key points in order to review. (forgetfulness is the problem → issue a pass (cookie) → show it on every visit → ah, that person! (session))

Now you know how a server recognizes us again. But all the server checks is the pass number. It cannot tell whether the person holding that number is really you.
So it is serious if the number is seen by others on the way. The next lesson covers HTTPS, which locks the data in transit so no one can peek at it along the way. Checking with a password that you really are that person is covered in detail in the security area.