title: authentication sessionid vs cookie
body: <p>I am trying to figure out the pros and cons of using sessionid based authentication vs cookie based authentication </p>
  
  <p>As far as I can see in cookie based authentication </p>
  
  <ul>
  <li>User submits a login request sending their credentials</li>
  <li>The credentials are checked against a database</li>
  <li>Cookie will be set with the user details </li>
  <li>This will be done over https and the cookies will be encrypted. </li>
  <li>In .net if this is the authcookie user identity will be set </li>
  <li>The db is hit just once and subsequent calls just check the auth cookie </li>
  </ul>
  
  <p>In case of session based authentication </p>
  
  <ul>
  <li>User submits a login request sending their credentials</li>
  <li>The credentials are checked against a database</li>
  <li>A session id is generated and is also stored in a db</li>
  <li>Cookie will be set with the user details and a generated session id </li>
  <li>Subsequent calls will compare the session id against the one in the database</li>
  <li>The db is hit every time</li>
  </ul>
  
  <p>Questions </p>
  
  <p>Is there any reason to prefer one over the other? Is the cookie based less secure (even if you encrypt and sign them)? Is the performance of session based worse since it hits the database during each call? I have seen several sites leaning one way or the other but could not get a clear picture of what approach to use. Any discussions/suggestions would be greatly appreciated.  </p>