It seems both do the same thing (or establishing a session between two hosts differs from establishing a connection between two?) So what exactly is the difference here that make us consider them as two separate layers?!
The way I usually explain it is to consider a concrete example of two browsers on a single computer, connected to the same website and logged in as different users.
- There are any number of transport connections as the web pages load pages and images.
- There are two sessions, normally identified with cookies or whatever.
As Zac says, the sessions are pretty much in the web browser and server, not anywhere else. The OSI model is to help describe things, not mandate how they're implemented.
In the Internet world, the OSI layers are not strictly followed.
Especially the session layer isn't implemented in the OS stack but (more or less) inside the application (or in a framework). For HTTP, think of session cookies or a session URL parameter - an HTTP client session can consist of a large number of TCP connections. For FTP, the 'session' is the control connection that can spawn data connections, and so on.
Well, The Transport Layer is responsible for giving services to the application layer: to get a message from an application program running on the source host and deliver it to the corresponding application program on the destination host by creating a logical connection.
But the Session Layer is more about the session (logical connection) management capabilities between hosts. For example, if some host needs a password verification for access and if credentials are provided then for that session password verification does not happen again.
This layer can assist in synchronization, dialog control, and critical operation management (e.g., an online bank transaction). and If some more functionalities in the session layer are needed for a particular application, they can be included in the development of that piece of software.