When logging in, the backend will generate some state (e.g. user privileges) and store it somewhere, alongside a random session ID. It might be stored on disk,

When logging in, the backend will generate some state (e.g. user privileges) and store it somewhere, alongside a random session ID. It might be stored on disk, in a database or in a KV store like redis. The backend returns this session ID in a cookie. You store this session ID as a client-side cookie, which gets sent on every request to your backend. When your backend receives a request, it will (typically using some kind of middleware) lookup the session ID in the backing store and deserialise the state. Sliding expiration is typically used, so as long as you keep making requests, you'll remain logged in. Revoking a single session ID is very easy, since you've just deleting a single row/key/line from your backing store.