When you sign in, many sites give your browser a cookie holding a session id. The browser sends it automatically with each request, and the server looks it up to know who you are. Whoever holds the cookie is effectively you.
Weak cookie settings are the failure. Without Secure, it can travel over plain HTTP. Without HttpOnly, an injected script can read it. Without a suitable SameSite value, other sites can trigger requests that carry it. Sites should also issue a fresh cookie on login to prevent session fixation.
Set the cookie with Secure, HttpOnly and SameSite Lax or Strict, keep the id random and unguessable, give it a sensible lifetime, and destroy it on the server when the user logs out. Auth libraries usually do this correctly, so check that custom code did not override their defaults.
Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Lax; Path=/