Issue a fresh session
After authentication, replace the previous session identifier. Keep the authoritative session state on the server rather than trusting a browser flag.
Protect the cookie
Use Secure over HTTPS, HttpOnly and an appropriate SameSite setting. Each addresses a different boundary; none replaces checking permissions on every protected route.
End access deliberately
Expire sessions and invalidate them on logout. For an administration panel, changing a password is also a useful point to revoke other active sessions.