# Security and Sessions

Security and Sessions: Authentication vs Authorization, Cookie Authentication and \[Authorize\], Session State.

Updated: November 3, 2026

1. [Authentication vs Authorization](https://www.ask-codey.com/lessons/security-and-sessions-authentication-vs-authorization) (Apprentice): Authentication asks who you are; authorization asks what you're allowed to do. A web app proves who you are once, at sign-in, then remembers you with a cookie on every request after.
2. [Cookie Authentication and \[Authorize\]](https://www.ask-codey.com/lessons/security-and-sessions-cookie-authentication-and-authorize) (Journeyman): Turn on cookie authentication in Program.cs, sign users in with claims and SignInAsync, protect actions with \[Authorize\] and roles, and show who's signed in with User.
3. [Session State](https://www.ask-codey.com/lessons/security-and-sessions-session-state) (Journeyman): Session state keeps small values on the server for one visitor between requests, such as recently viewed products, found through a session cookie. Turn it on, then SetString, GetString and SetInt32.

Source: https://www.ask-codey.com/courses/csharp-full-stack-bootcamp/topics/security-and-sessions