I think you're asking about authentication, not authorization. Are you asking whether the cookies are compared to server-side state (as with sessions) or conta

I think you're asking about authentication, not authorization. Are you asking whether the cookies are compared to server-side state (as with sessions) or contain authentication information that only the server can encrypt and decrypt?