Which statement about session cookies is true?

• A. They are never sent with requests
• B. They are sent with requests to the origin to maintain the session
• C. They only exist for non-authenticated sessions
• D. They contain user credentials in plain text

Answer: (B)

Session cookies are used to keep track of a user’s login state across multiple HTTP requests. The key idea is that once a server issues a session cookie, the browser automatically includes that cookie in subsequent requests to the same origin. This lets the server recognize and continue the same session without re-authenticating every time. Typically, the cookie stores only a session identifier, while the actual credentials live on the server; the cookie itself should not contain user credentials in plain text. That’s why the statement about session cookies being sent with requests to maintain the session is the correct one. The other options are inaccurate because cookies are indeed sent with requests, they can exist for authenticated sessions, and they should not store credentials in plain text.