sessionsID

A session identifier, commonly called a session ID, is a unique token assigned by a web server to track a user session across multiple requests. HTTP is stateless, so the session ID enables the server to retrieve per-user state from a server-side session store, such as login status, preferences, or a shopping cart.

Delivery and storage: The session ID is usually stored on the client as a cookie (often named sessionid, PHPSESSID, JSESSIONID, etc.) and sent with every request. Some legacy setups may pass the ID in the URL. Cookies typically use attributes like HttpOnly, Secure, and SameSite to reduce security risks.

Creation and lifecycle: A new session is created on the first request or at login, and a unique ID is issued and linked to a server-side data store. The server may regenerate a new ID after authentication to mitigate session fixation and can expire sessions after a period of inactivity or upon logout.

Security considerations: Protecting session IDs is critical because possession grants access to the session data. Use TLS to encrypt transport, invalidate or rotate IDs on login, set HttpOnly and Secure flags, and apply SameSite restrictions. Invalidate sessions on logout and implement reasonable inactivity timeouts to limit exposure.

Alternatives and scope: Some architectures use stateless tokens such as JSON Web Tokens (JWTs) that carry user claims without server-side state, trading off certain controls for scalability. However, true session IDs rely on a server-side store to retrieve data across requests.

In common frameworks, the session ID is retrieved by framework-specific means, and the cookie name varies (for example, PHP’s PHPSESSID, Django’s sessionid, or Java’s JSESSIONID).