Session Management and Application State

Explain how a session identifier links separate HTTP requests to a user's server-side session.

Trace the lifecycle of a session through creation, use, expiration, logout, and invalidation.

Compare server-side sessions with self-contained client-held tokens in terms of control, scalability, revocation, and data exposure.

Explain how local session state affects load balancing, horizontal scaling, failover, and recovery.

Compare sticky sessions, shared session stores, and stateless tokens as strategies for operating across multiple servers.

Justify a stateful or stateless session strategy for a given system using security, scalability, consistency, user-experience, and operational requirements.