I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (unsecured mostly and he claimed no one has used this way anymore since 2013).
His idea is to store user's credentials in the Web Browser's local storage instead and any request will need to attach credentials as a basic authentication header.
I don't see any big advantage of his idea and I believe the common way using session and cookie for authentication cannot be dead as he said. He insisted that his way is the best (no session anymore!) and can be used anywhere (well, he is younger than me but more talented anyway).