Seeking help with how authentication and credentials for software applications are managed...

Where should session management be used in an online application?

Web pages are typically requested distinctly and not as a group or even identified by user. How does this feature change when session management is enacted?

What would happen to the system without session management?

How could this system be compromised by an attacker if session management was not used?

An example showing why authentication is necessary as a point of entry into an application.

What type of information is being protected by authentication in this case?

What would happen if authentication was not used in this example?

Where could passwords be stored safely in an online application?

How would you suggest protecting them from accidental or brute$-$force discovery?