Is it correct that session based authentication is the same as cookie-based authentication?

These phrases are not the same: "cookie based" reflects how session information gets transmitted while "session based" reflects that a session is used instead of having to login for every transaction again. "Session based" might be implemented with cookies and it typically is, but this is not an actual requirement. One could transmit the session for example in the URL too.

Does session/cookie based authentication store user/session/... on server side?

Not necessarily. All information can be stored inside the (signed/encrypted) cookie so that only the client actually stores the information and the server can extract the information from the cookie. Or the cookie can just be a key to look up the information in the servers database in which there is no need to sign/encrypt it.

Is it stateful or stateless?

Depends on the meaning of these terms in the specific context. If one sees as a requirement for being stateful that both sides store state information then it is only stateful if the server uses the cookie as a key into the database where the actual state is stored. If one only cares that there is a state at all (compared to transmitting credentials with each request) and not where it is stored then it is also stateful if the state information are contained directly in the cookie and are only extracted by the server.

Is the difference between cookie based and token based authentication exactly that the former is not signed, while the latter is?

They are not the same but similar. A session cookie is usually set initially by the server and then implicitly reflected by the client in each request by the client inside the Cookie HTTP header field. An authentication token is usually created some other way (for example when signing up for a service) and is explicitly added to the request by the client, usually inside the Authorization HTTP header field. Both session cookie and authentication token are opaque to the client in that it does not care (and often does not know) the inner structure.

Is it correct that session based authentication is the same as cookie-based authentication?

These phrases are not the same: "cookie based" reflects how session information gets transmitted while "session based" reflects that a session is used instead of having to login for every transaction again. "Session based" might be implemented with cookies and it typically is, but this is not an actual requirement. One could transmit the session for example in the URL too.

Does session/cookie based authentication store user/session/... on server side?

Not necessarily. All information can be stored inside the (signed/encrypted) cookie so that only the client actually stores the information and the server can extract the information from the cookie. Or the cookie can just be a key to look up the information in the servers database in which there is no need to sign/encrypt it.

Is it stateful or stateless?

Depends on the meaning/interpretation of these terms in a specific context. First, there is always a state involved when having a session, compared for example to the case where authentication credentials are send with each request. So from this perspective session based authentication is always stateful.

But in some contexts the question is if both server and client keep the state information. In this interpretation it would not be stateful if all the state information are contained in the session cookie, since the server only extracts the state from the cookie and might update the state by sending a new cookie, but does not actually store the state locally.

Is the difference between cookie based and token based authentication exactly that the former is not signed, while the latter is?

They are not the same but similar. A session cookie is usually set initially by the server and then implicitly reflected by the client in each request by the client inside the Cookie HTTP header field. An authentication token is usually created some other way (for example when signing up for a service) and is explicitly added to the request by the client, usually inside the Authorization HTTP header field. Both session cookie and authentication token are opaque to the client in that it does not care (and often does not know) the inner structure.

Is it correct that session based authentication is the same as cookie-based authentication?

These phrases are not the same: "cookie based" reflects how session information gets transmitted while "session based" reflects that a session is used instead of having to login for every transaction again. "Session based" might be implemented with cookies and it typically is, but this is not an actual requirement. One could transmit the session for example in the URL too.

Does session/cookie based authentication store user/session/... on server side?

Not necessarily. All information can be stored inside the (signed/encrypted) cookie so that only the client actually stores the information and the server can extract the information from the cookie. Or the cookie can just be a key to look up the information in the servers database in which there is no need to sign/encrypt it.

Is the difference between cookie based and token based authentication exactly that the former is not signed, while the latter is?

They are not the same but similar. A session cookie is usually set initially by the server and then implicitly reflected by the client in each request by the client inside the Cookie HTTP header field. An authentication token is usually created some other way (for example when signing up for a service) and is explicitly added to the request by the client, usually inside the Authorization HTTP header field. Both session cookie and authentication token are opaque to the client in that it does not care (and often does not know) the inner structure.

Is it correct that session based authentication is the same as cookie-based authentication?

These phrases are not the same: "cookie based" reflects how session information gets transmitted while "session based" reflects that a session is used instead of having to login for every transaction again. "Session based" might be implemented with cookies and it typically is, but this is not an actual requirement. One could transmit the session for example in the URL too.

Does session/cookie based authentication store user/session/... on server side?

Not necessarily. All information can be stored inside the (signed/encrypted) cookie so that only the client actually stores the information and the server can extract the information from the cookie. Or the cookie can just be a key to look up the information in the servers database in which there is no need to sign/encrypt it.

Is it stateful or stateless?

Depends on the meaning of these terms in the specific context. If one sees as a requirement for being stateful that both sides store state information then it is only stateful if the server uses the cookie as a key into the database where the actual state is stored. If one only cares that there is a state at all (compared to transmitting credentials with each request) and not where it is stored then it is also stateful if the state information are contained directly in the cookie and are only extracted by the server.

Is the difference between cookie based and token based authentication exactly that the former is not signed, while the latter is?

They are not the same but similar. A session cookie is usually set initially by the server and then implicitly reflected by the client in each request by the client inside the Cookie HTTP header field. An authentication token is usually created some other way (for example when signing up for a service) and is explicitly added to the request by the client, usually inside the Authorization HTTP header field. Both session cookie and authentication token are opaque to the client in that it does not care (and often does not know) the inner structure.