Here what I means by the two :
Session Authentication : Stored "Is authenticated" state in a session variable.
Cookie Authentication : Stored "Is authenticated" state in a cookie protected from temper by HMAC.
Question : Is there any advantage to one way versus the other one from a security point of view?
The best reason I seem to find for the cookie approach is that the server has to store less data, which is unrelated to security.
Let's say you tell me that using cookie authentication is better...
I have seen so many web applications that use cookie authentication but fail to link it with the session. It's a problem because they store the user information like his access in the session. So, you can build a simple attack like login on your own account that has barely no permission, then steal the session cookie from an admin and then impersonate him.
By that, I mean that whatever strength the cookie based scheme had over the session approach, it just lost it (because of poor session management). In a scenario like above, a cookie based approach bring nothing security wise.