# Sessions Based Authentication

When discussing authentication, mainly the popular ones are Session-based, token-based and OAuth Authentication. Let’s dive deeper into the session based.

### **Session Based:**

Keeping it simple, there is a **DATABASE ONLY FOR** storing **ALL** of the user’s information (id, name, address, phone, ….). As a user when we navigate to the web and sign in, our important credentials (email & password) are passed from **CLIENT**(browser) to **SERVER**(backend).

After that, server retrieves the info given; from the **DATABASE**, matching the given parameters in the **DATABASE** there are two possibilities. If no record found so you know user is asked to login again, but if the info matches, so **SERVER** creates a session for that user. While server creates the session, it passes the **SESSION** **ID** to the client for reference.

Now, the **SESSION** is actually developed to ensure authenticity of the user logged-in, so that if someone entered correct credentials they can access the resources with ease. The **SESSION** **ID** passed is actually used by the client. Whenever **CLIENT** requests the **SERVER**, it passes the **SESSION ID**(Which client actually store in the browser cookie). For each request, server just recognise that this is the same user who logged-in earlier so let them access the resources allocated.

If you are thinking that where the **SESSION ID** is used to grant access to the user, so I appreciate your proactiveness and attention. The **SERVER** has some special memory allocated for the **SESSION INFO**, called **SERVER MEMORY(RAM:** This is in-memory storage used to store SESSION INFO temporarily for fast access**)**. Which matches **SESSION ID** from the **CLIENT** with the already stored **SESSION** **INFO** and determines **ACCESSIBILITY**. Although, if user logs out so the **SESSION INFO** is deleted to ensure the authenticity and security. Also **SESSION** **INFO** can be deleted automatically depending upon if there are some limitations of **SESSION TIME PERIOD** by the **SERVER**.

**BUT** the **SERVER MEMORY** is enough with respect to storage but not **for SCALABILITY \[FOR LARGE SYSTEMS\]**. Redis isn't mandatory for session management but is highly beneficial in distributed or high-load environments. Redis **boosts performance** by making critical data instantly accessible in memory, complementing the server's overall RAM usage without replacing the primary database. The **server memory (RAM) is inherently in-memory storage**, and Redis is an in-memory database service that typically runs in RAM, either on the same server or separate servers, depending on system requirements.

In short, Redis is an in-memory database service, typically runs in RAM and can be hosted on the same server or separate servers in a distributed setup. Redis is valuable because it provides additional **features and optimizations** on top of raw server memory that make it more useful for applications.