title: Sessions made sense to me before I started reading about them online
body: <p>The main thing I've gathered from reading about Sessions vs Cookies is that Cookies are stored on the client-side and that sessions are stored on the server-side. If sessions are stored on the server-side, then how does the server ever know which client is theirs? Clearly, something must be on the client-side.</p>
  
  <p>Whenever I use my self-rolled user authentication, I have a <code>session_token</code> column in my <code>users</code> database table. </p>
  
  <p>Then, this module tends to facilitate sessions for me:</p>
  
  <pre><code>module SessionsHelper
    def current_user
      User.find_by_session_token(session[:session_token])
    end
  
    def current_user=(user)
      @current_user = user
      session[:session_token] = user.session_token
    end
  
    def logout_current_user!
      current_user.reset_session_token!
      session[:session_token] = nil
    end
  
    def require_current_user!
      redirect_to new_session_url if current_user.nil?
    end
  
    def require_no_current_user!
      redirect_to user_url(current_user) unless current_user.nil?
    end
  end
  </code></pre>
  
  <p>I believe by sessions being stored on the server-side, they mean the <code>session_token</code> every User has. Further, the session hash must be on the client-side. If not, where is it? Notice, I'm storing the session_token of the user like this: <code>session[:session_token] = user.session_token</code>. Lastly, if I'm right that the session is on the client-side, how are it and the session_token kept secure?</p>
  
  <p>Lastly, is this the same way sessions tend to be handled on other frameworks (like Django, php frameworks, etc.)? If not, what are some key differences?</p>
  
  <p>Many thanks.</p>