The server stores the session, and the browser stores the cookie.

Think of them as two separate storage locations.

             SERVER                          BROWSER

      Stores Session                  Stores Cookie

      SESSIONS = {                    Cookie
          "A8sd83Jd83ks"              session_id=A8sd83Jd83ks
              :
          "abhishek"
      }

Step-by-step flow

Step 1: User logs in

Username: abhishek
Password: mypassword

↓

Browser sends them to the server.

Step 2: Server verifies the password

verify_password(password, user.hashed_password)

If correct...

Step 3: Server creates a session

session_id = "A8sd83Jd83ks"

Then stores it:

SESSIONS["A8sd83Jd83ks"] = "abhishek"

Now the server remembers:

A8sd83Jd83ks  →  abhishek

Step 4: Server sends only the session ID to the browser

response.set_cookie(
    key="session_id",
    value="A8sd83Jd83ks"
)

Notice carefully:

The server does not send the entire SESSIONS dictionary.

It sends only one small cookie:

session_id = A8sd83Jd83ks

Step 5: Browser stores the cookie

Now Chrome stores:

Cookie

session_id = A8sd83Jd83ks

The browser has no idea that this belongs to Abhishek.

It simply stores the value.

Step 6: User visits another page

Suppose the user opens

/dashboard

The browser automatically sends:

Cookie:

session_id = A8sd83Jd83ks

Step 7: Server receives the cookie

The server reads:

request.cookies.get("session_id")

which returns

A8sd83Jd83ks

Then it checks:

SESSIONS["A8sd83Jd83ks"]

Result:

abhishek

Now the server knows:

"This request is from Abhishek."

A simple analogy

Imagine a cloakroom at a theater.

At the cloakroom

You give your coat to the attendant.

The attendant stores it and gives you a token.

Attendant (Server)

Token 57  →  Abhishek's Coat

You carry only:

Token 57

You do not carry the coat.

Later you return and hand over:

Token 57

The attendant looks up:

57 → Abhishek's Coat

and returns your coat.

In this analogy:

• Session = the coat stored by the attendant (server)

• Cookie = the token you carry (browser)

• Session ID = the token number connecting the two

This is exactly how most session-based login systems work.