You don't need a cookie banner for authentication/shopping basket cookies, since these are essential.

However, you are still required to provide a list of essential cookies and their usage somewhere on the website.

This. I don't know why there's a heavy overlap between the "GDPR didn't go far enough" people and not actually reading the GRPR. I'd think they would overlap a lot with people who actually read it.