User session between two Laravel apps

I have two Laravel apps:

1. Interface (Laravel application which makes API requests to Core service and has no MySQL or any service connected to it)
2. Core (Laravel application, without UI, implements all the logic based on a request from Interface)

Scenario:

1. User visit /login page
2. Fill out the form
3. Request sent to Interface
4. Interface sends all data to Core
5. Core checks that User exists
6. Response that all good
7. User logged in and redirected to /home

Problem: I don't really understand in which direction should I move to save the session in Core (for example if I want that session automatically expires in 4 days). Also, what should I store on the user's side? Cookie? Then how to make cookies secure from Cookie Hijacking?