session
termweb devsecurity
The server's memory that a particular client has already been authenticated, usually represented by a token the client returns.
Sessions exist because the protocol underneath does not remember anything, so each request must carry proof of a decision made earlier. That proof is bearer material: whoever holds it is treated as the user, which is why session theft skips authentication entirely and why lifetime, binding and revocation are the controls that actually matter. A logout that only clears the client leaves a valid token in the hands of whoever copied it.
Also known as: session cookie