A session maintains a user's login state between HTTP requests, which are stateless. The server stores the session and sends an identifier in a cookie. This cookie must be HttpOnly, Secure, and have a SameSite attribute, to limit theft and CSRF attacks.
Example
Set-Cookie: sid=abc123; HttpOnly; Secure; SameSite=Lax