Individual data items associated with the session are then referenced by a "key", which is used both to store and retrieve the data. Django uses a cookie containing a special session id to identify each browser and its associated session with the site. The actual session data is stored in the site database by default (this is more secure than storing the data in a cookie, where they are more vulnerable to malicious users).