Easy Auth Question 56 of 226

How does a classic server session cookie work?

Java Specialist · Speak this in 60–90 seconds · Faridabad & Delhi NCR

PICTURE THIS: A REST CALL

ClientGET /users/1

ServerFind row

JSON back200 OK

Simple meaning

After login the server stores session data in memory or Redis and sends a session id in a Set-Cookie header.

WHY — Auth instead of guessing?

Why interviewers care about Auth:

This is a process

question about Auth.

Panels listen for order,

trade-offs, and what you would actually do on a Backend project - not buzzwords.

Stay structured

Name the idea, why it exists, then one short example.

Close cleanly

End with when you use it and one common pitfall.

STEPS — What happens step by step?

Before you speak the answer, walk the interviewer through these steps:

1
After login the server
stores session data in memory or Redis and sends a session id in a Set-Cookie header.
2
The browser sends that
cookie on later requests so the server can look up the user.
3
Mark it HttpOnly, Secure,
and SameSite to reduce XSS and CSRF risk.
4
Give an example
One tiny concrete case you can say aloud.
5
Common mistake
What juniors usually get wrong.
6
Close
When you pick this over the alternative.

EXAMPLE — See it in action

Here's a short line you can speak, broken into clear beats:

Say this line

“The browser sends that cookie on later requests so the server can look up the us”

Break into beats

Thebrowsersendsthatcookieon

Speaking order

2987408337471632900

Note: Adapt this scaffold to your own project — keep it under 60–90 seconds.

Key takeaway

After login the server stores session data in memory or Redis and sends a session id in a Set-Cookie header. The browser sends that cookie on later requests so the server can look up the user.