Comment by yuvadam

Cookie-based sessions have many, very reasonable, use cases.

You are also clearly neglecting the fact that proper session cookies are _always_ cryptographically signed and cannot be tampered with, if properly implemented.