cookie is maintained by the browser and session is maintained by the server. There is no absolute relationship between the two, but in general, the server uses cookie to maintain session.

as for limitation:

• session cookie is deleted when the browser is closed (or the next time it starts), so session cookie will not expire as long as the browser is not closed.
• session will expire if it is not read / set for a certain period of time.

you can find that they are not Synchronize, so why can't you actually feel them? Because the session cookie will not expire if you do not restart the browser or delete the cookie, manually, and most users will not log on to a website and do not operate for a few hours (live / video websites will have network requests even if they do not operate, and the background can automatically renew them), so the session can also be maintained.
you can try this operation:

• Log in to a website (do not choose to log in automatically), then restart your browser, and then visit the site, and the landing page should appear.
• Log in to a website (such as a forum, do not choose to log in automatically), then do not click on the page for two hours, do not close the browser, and then see if re-login is required.

as for seven-day login-free, it is generally necessary to add salt hash, and record some of the user's information to the database, and set a new cookie, to expire for seven days. When users visit the website, if they do not log in, they will automatically log in if the cookie is correct. From the user's point of view, it is login-free.

what I understand is that the jsessionid in cookie stores sessionId, and the server needs to retrieve session
Tomcat based on this Id. By default, it is implemented in ConcurrentHashMap

protected Map<String, Object> attributes = new ConcurrentHashMap<String, Object>();

1. jsessionid is gone. You need to log in again to get a new jsessionid

it's time for 2.session to be destroyed. Depending on whether the session, cannot be obtained by sessionId, whether to re-create a new session depends on the configuration

javax.servlet.http.HttpServletRequest.getSession(boolean create)

3.session mechanism, the life cycle of jsessionid is before the browser is closed

4. Login-free, the user name and password can be encrypted and stored in the client through Cookie. When the Session on the server is destroyed, the login operation is performed again using the information stored in the Cookie to rebuild the Session, and update the Session ID stored in the Cookie on the client