After login, the server issues a signed session ID (cookie). The browser sends it with each request. Stateless on the client, but the server must store session state. Vulnerable to session hijacking if cookies are not HttpOnly , Secure , and SameSite .
All authentication methods derive from three classic categories, often called "factors." Modern systems combine these for strength. authentication
The most common factor, including passwords, PINs, or answers to security questions. After login, the server issues a signed session ID (cookie)