I've heard that cookies is less secure than the session.
For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he can read the cookie and forge one easily. Here is a link that I've found: Session vs Cookie Authentication
Now I'm using Tornado with python to build a website. Here is a simple example of the module of login with Tornado: https://stackoverflow.com/questions/6514783/tornado-login-examples-tutorials
To my surprise, there is no session in Tornado. Its doc says that there is the secure cookies but I don't think it is safer than ordinary cookies.
browser ------- I'm Tom, my password is 123 -------> server
browser ------ &^*Y()UIH|>Guho976879 --------> server
I'm thinking that if I could get
&^*Y()UIH|>Guho976879, I can still forge the cookie, right?
If I'm correct, why doesn't Tornado have the session? Or is there some way that can make the secure cookie is the same secure as the session? Maybe that I erase the cookies when the browser is closed can be safer?