I haven't used sessions in over a decade and haven't regretted that decision once. It opens up a whole new class of problems you don't have when using client-side frameworks.

So what do you use instead?

It depends on the specific data. Do you have anything that you store in session in mind?

Having the client/server split has made this a lot easier to reason about. I store client state on the client and server state stays on the server.

I’m talking about auth, like a session cookie. What do you use for auth?

I use Entra, so the session cookies are created through login.microsoft.com. Which means I'm not actually managing the session.

When I said I don't use sessions, I should have specified I don't use them for application state (or roles and stuff).