Are session attributes really stored in cookie?

[Timothy Sam]

I thought they were stored server-side, but a friend told me that they are stored in browser cookies. Is this true? I happen to be saving the username and password in session scoped variable and this made me worry.

[Bear Bibeault]

No. Session attributes are not stored in cookies.

[Christophe Verré]

Things you add using addCookie() will be in a cookie, not session attributes.

[Bear Bibeault]

Your friend is confused. The session id is usually stored in a cookie. But this is just a value that allows the container to keep track of the session across requests. It in no way contains the values of session scoped variables.