Why should I use cookies other than for storing a session id? <p>For HTTP as far as I understand are two ways to store data belonging to a client and bring some kind of state into a otherwise stateless Browser-webcontainer-connection: 1) Data stored in cookies on the client-side - or 2) A session ID stored in a cookie and the associated data stored in a webcontainer on the server-side. When I compare these two possibilities I can't come up with a reason, why one should go the first way. But still, when I look at my browser's cookies, I see a lot of data stored in them. </p> <ul> <li>A webcontainer (like tomcat) can store arbitrary data together with a session id - A cookie is quite limited in size.</li> <li>Cookies are more vulnerable, since they are stored on the client's side. Keep data on the server-side is, as it looks for me, just more secure. </li> <li>Both, cookies and webcontainer-sessions, can define expiration dates.</li> <li>Both, browser and webcontainer, persist their data over restarts.</li> </ul> <p>Can anyone come up with a scenario where the use of cookies for storing session data has benefits or is even necessary?</p>