Session

When you use a website, your device sends many individual requests to the provider’s computer. Each of these requests is, in itself, completely self-contained. So the provider would have to ask anew with every click: Who are you, exactly? A session solves this problem. It is a coherent stretch of usage during which the provider recognizes you and your history so far. It usually begins with logging in or opening the page and ends with logging out, closing the window, or after a certain period without activity.

Why a shopping cart doesn’t work without it

The benefit becomes clearest with an online shop. You put a pair of trousers in the shopping cart, then click on another page and want to add a T-shirt as well. Without a session, the cart would be empty again on the second click. The shop would have no way of knowing that the second request came from the same person as the first.

The same applies to logging in. You enter your password exactly once, not with every single click. The service remembers, for the duration of the session, that you have already identified yourself. This is precisely why a session is also a security-relevant asset. Whoever steals it is indistinguishable from you as far as the service is concerned.

For companies, sessions are also an important metric. Statistics often count not clicks but sessions per day. This says more about how many people actually use a service. This figure regularly turns up in tech companies' quarterly results.

The identifier behind the scenes

Technically, a session is usually underpinned by a long, random string of characters: the session ID. The service generates it at the start and sends it to your browser. The browser stores it in a small file, the cookie, and attaches it to every further request. You can picture this like a coat-check ticket at the theater. The ticket itself contains no information, but the provider knows which coat it belongs to.

The actual data therefore resides with the provider, not with you. That’s where it’s recorded who you are, what’s in the cart, and when you were last active. This is also why logging out takes effect immediately: the provider declares its entry invalid, and the ticket in your browser becomes worthless as a result. For the same reason, session IDs should be random and long, so that no one can guess them.

With AI chatbots, session means something similar, but not quite the same. There it refers to the ongoing conversation that the model remembers. The distinction from training is important: what you write in a session normally does not change the model itself. The conversation so far is simply resent along with every new question. Once the session ends or the context window is full, this knowledge is gone.

From online banking to a new chat

You encounter this principle constantly in everyday life, usually without the name. With online banking, you’re automatically logged out after just a few minutes of inactivity. This is a deliberately short session timeout, because the risk there is especially high. With a streaming service, on the other hand, you often stay logged in for months.

The “New chat” button in an AI tool, too, starts nothing other than a fresh session. This is a practical tip: if a chatbot has gotten stuck in a misunderstanding, starting a new conversation often helps more than further corrections. Otherwise the old history keeps pulling the answers back in the same direction.

In the news, the term mostly comes up in connection with security incidents. Session hijacking refers to attackers intercepting someone else’s session ID and using it to get into an account without a password. Countermeasures include encrypted connections, short lifespans, and a new ID after every login. A public computer where no one logs out is therefore a genuine risk.