Security and Sessions

Security and Sessions: Authentication vs Authorization, Cookie Authentication and [Authorize], Session State.

Updated November 3, 2026

1. Authentication vs Authorization (Apprentice): Authentication asks who you are; authorization asks what you're allowed to do. A web app proves who you are once, at sign-in, then remembers you with a cookie on every request after.
2. Cookie Authentication and [Authorize] (Journeyman): Turn on cookie authentication in Program.cs, sign users in with claims and SignInAsync, protect actions with [Authorize] and roles, and show who's signed in with User.
3. Session State (Journeyman): Session state keeps small values on the server for one visitor between requests, such as recently viewed products, found through a session cookie. Turn it on, then SetString, GetString and SetInt32.