1. 使用者第一次訪問，伺服器建立 Session
   Session ID: "abc123"
   Session Data: {}

2. 伺服器將 Session ID 透過 Cookie 傳給客戶端
   Set-Cookie: sessionId=abc123; HttpOnly; Secure

3. 之後每次請求，客戶端自動帶上 Cookie
   Cookie: sessionId=abc123

4. 伺服器用 Session ID 查找對應的 Session 資料

5. 使用者登出或 Session 過期，伺服器刪除 Session 資料

// 取得或建立 Session
HttpSession session = request.getSession();

// 設定 Session Attribute
session.setAttribute("user", "Charmy");

// 讀取 Session Attribute
String user = (String) session.getAttribute("user");

// 刪除 Session Attribute
session.removeAttribute("user");

// 使 Session 失效 (登出)
session.invalidate();

const session = require('express-session');

app.use(session({
  secret: 'mySecret',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true }
}));

// 設定 Session Attribute
req.session.username = 'Charmy';

// 讀取 Session Attribute
const username = req.session.username;

// 登出
req.session.destroy();

from flask import Flask, session

app = Flask(__name__)
app.secret_key = 'mySecret'

# 設定 Session Attribute
session['username'] = 'Charmy'

# 讀取 Session Attribute
username = session.get('username', 'Guest')

# 刪除 Session Attribute
session.pop('username', None)

session_start();

// 設定 Session Attribute
$_SESSION['username'] = 'Charmy';

// 讀取 Session Attribute
$username = $_SESSION['username'];

// 刪除 Session Attribute
unset($_SESSION['username']);

// 登出
session_destroy();