Session cookie
A session cookie is a browser cookie without a fixed expiry time. In security discussions, the phrase also commonly means a cookie that carries an application's session identifier and helps keep a user signed in.
How a website remembers your sign-in
In a common web application, signing in creates a server-side session. The application sends the browser a cookie containing the session identifier. When you make another request, the browser sends the cookie back if its scope and security rules allow it. The application checks the session before returning protected information.
This is why opening another page can work without another password prompt. The cookie lets the application associate the request with an existing session.
“Session” describes two different things
Strictly, a session cookie has neither an Expires nor a Max-Age attribute. That describes its browser lifetime, not its purpose. A cookie used for authentication can instead have an explicit expiry, and a session cookie can serve an unrelated purpose, such as remembering a shopping cart.
The browser decides when its session ends. It may restore cookies after a restart, so closing the window does not reliably end access.
Where tokens fit
A browser session and an API token can coexist. A portal might recognize your browser through a cookie while using an access token to request data from another service. They serve different connections and can have different lifetimes.
Browser sends it to the web application.
Purpose: identify the application's session.
Client sends it to the API (resource server).
Purpose: request a protected operation.
Client sends it to the authorization server.
Purpose: request a new access token.
If the application still accepts a stolen session credential, an attacker may be able to use it for session hijacking. Check how that application ends sessions. When verifying that access has stopped, make a fresh protected request; a page already open in the browser may just be cached.