A Session is always stored at the Server side. In JSP, session is a built-in object in JSP container.
A Cookie is always stored at the client side.
We can use both the methods for Session tracking. But Cookie method needs permission from user for storing cookie at the client location.Read the full book at www.amazon.com