In laravel, by default all your routes put inside the web.php are using all of the middlewares defined in the "web" middleware group. Under app/Http/Kernel.php you can check:
protected $middlewareGroups = [
'web' => [
// ...
\Illuminate\Session\Middleware\StartSession::class,
]
];
As you can see, the middleware for creating a session is always active, that means even if the user isn't logged in, a unique session for that user has already been created. So you can store and return things from the session using the session() helper function or the Session facade.
It's possible that once you login, the session will be destroyed and a new one is created, I don't remember. If you want to keep the cart, you would need to store in in a variable, allow the session from the logincontroller to run and then readd the cart to the session.