we will have a table called session table to manage that.
something like this:
Authentication Service in System Design_ide
the session_key here sounds like a token.

what will happened after user login:
create a session object,
return the session_key as cookie to broswer
each time when the user request something from this server, it will automatically added all the cookies of this website.
each time the server will check if the session_key in cookie is within expired_data. if everything is fine, then 200

what will happened after user logout:
we delete the data from session table. so technically, session table is cache that we can’t store them in server side.