A click turns a URL into an HTTP request, and the server answers with a status code. A cookie is the wristband the server hands you so stateless HTTP can recognize you. By the end you can find one request in DevTools' Network panel and point to its URL, method and cookie. The examples only hit your own machine.
XSS happens when a site puts user input into a page unchanged, so another person's browser runs it as code; the fix is escaping on output. IDOR happens when a server hands over whatever id it is asked for without checking the record is yours; the fix is an ownership check on the server. Google's table puts XSS under 'execute code on the client' (C0), $10,000 base on a standard Google app, and IDOR under logic flaws (S2), priced by how sensitive the exposed data is: on the same standard Google app, $3,133.7 to $31,337.
Authenticated browser state is not a convenience setting; it is a credential that can impersonate its owner. Use a dedicated low-privilege account and isolated profile, separate reading from reversible writes and high-risk transactions, and leave MFA plus final submission to a human.