Hi everybody,

I’ve got two (mostly unrelated questions if anyone can help me). The more I read the more I’m confused about session based cookies vs session based tokens vs session based api keys; I even see some sites perhaps using the word “key” instead of token.

Question 1: If session-based cookies are so unsafe, why do Amazon and Banks use them? What’s stopping someone from hijacking the cookie and buying a ton of stuff on my Amazon account or doing the same to my bank account?

Question 2: I have been reading about crypto trading bots and I read that the bots are dangerous because the bot maker could steal your api key; Is there a way to use them where they don’t need these api keys? Why don’t these bots use other session-based methods like what I read about called JWT tokens or Oauth?