The session authentication flow

Session-based and cookie-based authentication can be understood in the following example authentication flow:

1. The user sends their credentials, for example, username and password, from the client app on their browser to the server.
2. The server checks the credentials and sends a unique token (session ID) to the client. Also, this token will be saved in a database or memory on the server side.
3. The client app stores the token in cookies on the client side and will use it in every HTTP request and send it back to the server.
4. The server receives the token and authenticates the user and then returns the requested data to the client application.
5. The client app destroys the token when the user logs out. Before logging out, the client can also send a request to the server to remove the session, or the session will end by itself depending on the expiration time that has been set.

In session-based authentication, the server does all the heavy...