With server-side sessions, the browser receives a session identifier in a cookie. The server stores the corresponding session state in a session store.

Important cookie attributes include Secure, HttpOnly, SameSite, Domain, Path, and expiration controls.

HttpOnly prevents JavaScript from reading the cookie. Secure restricts transmission to HTTPS. SameSite controls cross-site cookie behavior and helps mitigate CSRF in appropriate configurations.