What a Mobile Developer Learned Diving Into Cookies, Sessions, and Auth
A React Native developer's journey from "how do I keep a user logged in?" to the one distinction that made web auth finally click, plus a strong (and debatable) opinion on when to use each.
Back in 2022, I got an opportunity I am still grateful for: working on a real, live React Native project at my previous organization. It was the kind of project you learn a lot on. Along the way, as I picked up TypeScript, I also got my hands dirty with backend work in Node, and I ended up shipping a few backend projects I was genuinely proud of.
I never fully let that go. Even after moving on, I kept building small and medium side projects in Node, partly to stay sharp and partly because I enjoy it. Recently I sat down to catch up on what has changed in the ecosystem, and, as these things go, I fell down a rabbit hole. It started with something that looks deceptively simple: cookies and sessions.
I was not starting from zero. A few days earlier I had been revisiting the JWT, access token, and refresh token model from the mobile side, the stuff you deal with when your app talks to an API. So the vocabulary was not new. But I realized I understood it the way a lot of us do: I could use it, but I could not cleanly explain why it is built the way it is.
