A server-side session stores state on the server and gives the client an opaque session identifier; it supports straightforward revocation but needs shared or replicated session storage. A self-contained token carries claims and can be verified without a session lookup, but revocation and permission changes are harder until expiry unless additional state is introduced. Cookie security, CSRF, XSS, token lifetime, and refresh rotation matter in either design.