Where exactly are session data stored and how does the server match specific session data with a particular HTTP request?

Session data is stored on the server.

Mapping an HTTP request to session data occurs via the session identifier (Session ID).

1. Creating a session: When a client makes the first request, the server creates a new session, generates a unique Session ID, and sends it to the client as a Cookie (most often) or includes it in the URL.
2. Storing Session ID on the client: The client's browser saves the Session ID (in a Cookie).
3. Subsequent requests: For each subsequent request to the same domain, the browser automatically sends the Session ID back to the server in the Cookie header.
4. Mapping on the server: The server receives the Session ID from the request, looks up the corresponding session data in its storage (memory, filesystem, database, Redis, etc.), and uses it to process the request.

Example of a request header with Session ID in Cookie:

GET /profile HTTP/1.1
Host: example.com
Cookie: sessionId=abc123xyz456; anotherCookie=someValue