Session tokens carry authentication authority beyond the login request

After login succeeds, subsequent requests depend on a session token rather than another password check.

OWASP explains that an authenticated session identifier temporarily carries authority equivalent to the authentication method used.

I would therefore treat session handling as credential protection, not as ordinary application state management.

Token exposure can let an attacker impersonate a user even when the original login was strong.

If permissions remain necessary, then cookie defenses must complement session protection rather than substitute for it.

The implementation needs deliberate creation, transport, expiration, and invalidation rules across the entire session lifecycle.

Review the authenticated journey beyond login, because security must persist through subsequent requests and logout.