Where should cookies and sessions be written in Yii2, in the model or in the controller?

Question

Yii

Hello.
There is a model for authorization. It will set up the data in the cookie and session.
It is right?
After all, the model must receive data from the controller. If you take out the session processing in the controller, you get code duplication.
Since the controllers for authorization - outputs are different.

Answer 1

There is a model for authorization. It will set up the data in the cookie and session.
It is right?

Why not?

Answer 2

Yii2 has models for forms. In the example (application template), this is where authorization cookies are set, through the User component.
I don't see anything wrong with that.