I'm sure tptacek will be along shortly to elaborate.

One would think it gets stored in the database, but man all these hashes are so slow to generate. And which library are we using again for that? bcrypt? scrypt? Seems unnecessarily slow. I bet SHA256 is good 'nuff, and way faster.

Lets just meanwhile call the cloud consultant to move this to a separate service.

Have you heard the good word about AWS Cognito? I heard its web scale.

Nah, too expensive, we should just write our own real quick how hard can it be..

Most sites would be lucky to have this problem. Store your sessions in redis and call it a day.

Not localstorage. :)

I've seen them in http-only cookies which is sent with every request but not inspectable by js. The server can automatically refresh the token every-so-often transparently without the client even being aware or able to influence it in any way.

I've worked at a couple of places where the session token lookups were the bulk of database traffic - to the extent that one place had to split it off to its own cluster just to stop it clogging everything up.