Next.js › Cookies & Session Management in Next.js
What is the difference between storing session data in a signed cookie versus a server side session store?
AdvancedAnswer
A signed cookie stores the session data directly inside the cookie itself, verified with a signature so it cannot be tampered with, while a server side session store keeps only a reference identifier in the cookie and stores the actual data in a database, which is more secure for sensitive information and easier to revoke.
// Signed cookie approach stores encoded data directly
// Server side store approach only stores a reference id
const sessionId = cookieStore.get('sessionId');
const session = await redis.get(sessionId);Real-world example A banking application uses a server side session store so that sessions can be instantly revoked if suspicious activity is detected, which would not be possible if the session data lived entirely inside the user's cookie.