A user session preserves state across separate requests. Joomla uses sessions to remember signed-in users and information about their interaction with the website.
Identifiers and session data
A browser normally stores a session identifier in a cookie, while application state resides on the server. The storage backend depends on configuration. A session identifier is a secret: leaking it may allow someone to use another person's session.
The application controls expiry, so closing a tab does not necessarily end a session. Remember Me can use a separate persistent sign-in mechanism and is not the same as ordinary session lifetime.
Joomla checks
For Joomla, test login, logout, inactivity expiry and forms. After changing HTTPS, domains or storage, confirm that cookies are sent correctly and session data persists.
Protect Joomla sessions with HTTPS, suitable cookie attributes and identifier regeneration when the authentication context changes. Shared caches must not deliver personal content to other visitors. Keep identifiers and cookies out of URLs and public logs.
Conclusion
A session connects requests into one interaction. Verify it through actual sign-in, protected pages, timeout and logout.