HTTP is a stateless protocol, so session management requires client-side persistence. Cookies are the standard mechanism - the server sends a Set-Cookie header with a session identifier, and the client returns it on subsequent requests. Memory flags, request IDs, and request parameters don't persist across requests.