Login session
Also called Session, Server-side session
The server's memory of a signed-in user. At login it creates a record and gives the browser a long random id in a cookie. Each later request carries the id, so the server can look up who it belongs to.
An agent asked for "login" will produce something that lets the right person in, and you won't see the gaps by logging in. The questions to ask are whether logging out really ends it, and what happens to a stolen copy.
Say it to your agent
“On login, generate a new session id of at least 64 bits from a secure random source and store the session row on the server. On logout, delete the row, then show me that replaying the old cookie with curl gets a 401.”