A session maintains the state of a logged-in user across several requests. The server generates a random identifier that is hard to guess, stores it, and associates it with the user; it is renewed after login, expires, and is invalidated at logout.
Example
Set-Cookie: sid=9f8e…; HttpOnly; Secure