Java EE (Java Enterprise Edition) General Discussion

Hello.

I have a question about how Tomcat performs session managment that I can't quite seem to find an answer for.

When you put data into a session, such as a logonid, is the session data sent back to the client and stored in the cookie, or is it kept on the server side (in memory?) and accessed via the sessionid when the user returns? If you use WebScarab or achilles to watch the traffic, it doesn't appear that the data goes back to the client. (Which is a good thing for security). Just wanted to confirm that.

Thanks very much.