Session

Definitions

A server-recognised period of interaction that lets a stateless protocol such as HTTP remember who a user is between requests. In the classic design the server creates a random session ID at login, stores the associated state (user, permissions, cart) in memory, a database, or a cache such as Redis, and hands the browser only the ID in a cookie. The alternative is a self-contained signed token such as a JWT, which moves the state to the client and removes the server lookup at the cost of making early revocation hard. Either way, the session identifier is effectively a bearer credential, so it should be long and unguessable, sent only over HTTPS, marked HttpOnly and Secure, and rotated at login to prevent session fixation. Sessions end by explicit logout, idle timeout, or absolute expiry, and choosing those limits is a trade between convenience and the window an attacker has with a stolen cookie.
In plain English: A way for a website to remember who you are between page loads, usually by storing a small ID in a cookie.
Example: "The session expires after 30 minutes of inactivity and the user has to log in again."