Browser cookie authentication

Browser cookie authentication uses stateful HTTP headers to store session identifiers on the client for automatic server-side validation.

This mechanism relies on the Set-Cookie header to drop a unique session ID into the user's browser after a successful login. For every subsequent request, the browser automatically attaches this token (via the Cookie header), allowing the server to map the request to an active session in a database like Redis or PostgreSQL. To secure this process, operators must implement the HttpOnly flag to block XSS access, the Secure flag to mandate HTTPS, and SameSite=Lax to mitigate CSRF attacks. It remains the industry standard for traditional web applications where the server manages state and requires seamless, transparent persistence across page reloads.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies