Cookie-based Session

A cookie-based session is a method where an identifier stored in a cookie or browser store stitches a user's consecutive visits together to form one continuous “session.”

Without a stable identifier, each request to the server is independent and memoryless; a cookie or browser store creates that memory so the server can tell two requests came from one user. A session's boundary is usually defined by a time rule: if the gap between two actions exceeds a limit (often thirty minutes), a new session begins. Several subtleties live here. First, a cookie-based session is tied to that device and browser, so one user on a phone and a laptop is seen as two separate users unless they log in. Second, if the user clears the cookie or the browser restricts it, that same user's next visit counts as a “new user” and the returning-user count falls short. Third, the difference between a first-party cookie (on the site's own domain) and a third-party one matters; today's browsers heavily restrict third-party cookies, so modern analytics relies on first-party identity.