In a nutshell
HTTP is stateless — each request is independent and remembers nothing — so a site needs a trick to keep you logged in. When you submit your password, the server verifies it, creates a session (a record of who you are) in its own store, and replies Set-Cookie: session=<id>. The browser saves that cookie and automatically attaches Cookie: session=<id> to every later request, so the server looks the id up and knows it's still you. The cookie only carries an opaque id; the real data stays server-side. A token/JWT is the alternative, where the signed cookie carries the identity itself.
