HTTP forgets you between requests, so being logged in needs a trick.
Cookie
A small piece of text a server asks the browser to keep. The browser then attaches it to later requests to that site, by itself. It's how HTTP, which has no memory, comes to know you.
The security of a login rests on a few words after the value, and they're easy to leave out, because a cookie without them works fine in every test. Asking for them by name gets them. They also explain "works on localhost, not in production".
Say it to your agent
“Set the session cookie with HttpOnly; Secure; SameSite=Lax; Path=/ and no Domain. Add a test that reads the Set-Cookie header from POST /login and fails if any of those is missing.”