The CKA_TOKEN attribute identifies whether the object is a token object or a session object.
We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely stored inside memory of PKCS#11 enabled device. For example secret AES key, especially when it is not extractable.
What about session keys and their security?
When a session is closed, all session objects created by the session are destroyed automatically, even if the application has other sessions “using” the objects.
So anyone able to eavesdrop my session will be able to see the clear-text value of my secret key? For example when I would like to translate key between two end points, it has to be unwrapped and wrapped with different key, meaning it should be somewhere in session in clear-text for some short time. Is it in system memory? Or is it somehow secured?