In more detail
Because HTTP is stateless, a session cookie is how a site recognises you after you log in. The server sets a cookie with a Set-Cookie response header, and the browser returns it in a Cookie header on later requests to the same domain and path. With Expires or Max-Age it persists; without them it disappears when the browser session ends. Browsers allow about 4 KB per cookie. Security attributes matter: Secure (HTTPS only), HttpOnly (hidden from scripts) and SameSite (limits cross-site sending). Third-party cookies, set by other sites embedded in a page, are used for tracking and are restricted by many browsers.
Why it matters
A session cookie without HttpOnly can be stolen by an Cross-site scripting (XSS) bug, and one without SameSite is easier to abuse in CSRF attacks. In the EU and similar jurisdictions, non-essential cookies such as analytics and advertising need the visitor's consent.
Example
Set-Cookie: session=7f3a9c; Path=/; Max-Age=3600; Secure; HttpOnly; SameSite=Lax
For the next hour (3,600 seconds) the browser sends Cookie: session=7f3a9c with every HTTPS request to the site, and JavaScript cannot read it.