When a user submits a POST login request, their credentials are encrypted in the request body (avoiding URL leaks) and sent to the server. The server checks for rate limits, retrieves the user's stored salted password hash from the database, and compares it against a newly computed hash of the incoming password. If they match, the server generates an encrypted session token (like a JWT) and sends it back—ideally as a secure, HttpOnly cookie—which the browser automatically includes in future requests to keep the user logged in.