Karl Jones: /* External links */

2016-04-26T02:58:43Z

‎External links

Karl Jones: /* See also */

2015-09-13T11:54:55Z

‎See also

Karl Jones: /* See also */

2015-09-13T11:54:09Z

‎See also

Karl Jones: /* See also */

2015-09-13T11:13:19Z

‎See also

Karl Jones: Created page with "In computer science, a '''session identifier''', '''session ID''' or '''session token''' is a piece of data that is used in network communications (often over HTTP) to..."

2015-09-13T11:09:27Z

Created page with "In computer science, a '''session identifier''', '''session ID''' or '''session token''' is a piece of data that is used in network communications (often over HTTP) to..."

New page

In [[computer science]], a '''session identifier''', '''session ID''' or '''session token''' is a piece of data that is used in network communications (often over [[HTTP]]) to identify a [[Session (computer science)|session]], a series of related message exchanges.

== Description ==

Session identifiers become necessary in cases where the communications infrastructure uses a [[stateless protocol]] such as HTTP.

For example, a buyer who visits a seller's site wants to collect a number of articles in a virtual shopping cart and then finalize the shopping by going to the site's checkout page. This typically involves an ongoing communication where several webpages are requested by the client and sent back to them by the server. In such a situation, it is vital to keep track of the current state of the shopper's cart, and a session ID is one way to achieve that goal.

A session ID is typically granted when a visitor first visits a site.

== Different from User ID ==

Session ID is related to, but different from, user ID.

Sessions are typically short-lived (they expire after a preset time of inactivity which may be minutes or hours) and may become invalid after a certain goal has been met (for example, once the buyer has finalized an order, the session ID expires and becomes invalid).

== Security issues ==

As session IDs are often used to identify a user that has logged into a website, they can be used by an attacker to [[Session hijacking|hijack the session]] and obtain potential privileges.

A session ID is often a long, randomly generated string to decrease the probability of obtaining a valid one by means of a [[brute-force search]]. Many servers perform additional verification of the client, in case the attacker has obtained the session ID.

Locking a session ID to the client's [[IP address]] is a simple and effective measure as long as the attacker cannot connect to the server from the same address, but can conversely cause problems for a client if the client has multiple routes to the server (e.g. redundant internet connections) and the client's IP address undergoes [[Network Address Translation]].

== Session token management ==

A session token is a unique identifier, usually in the form of a hash generated by a [[hash function]] that is generated and sent from a [[Server (computing)|server]] to a [[client (computing)|client]] to identify the current interaction session.

The client usually stores and sends the token as an [[HTTP cookie]] and/or sends it as a parameter in [[GET (HTTP)|GET]] or [[POST (HTTP)|POST]] queries.

The reason to use session tokens is that the client only has to handle the identifier (a small piece of data which is otherwise meaningless and thus presents minimal security risk). All session data is stored on the server (usually in a [[database]], to which the client does not have direct access) linked to that identifier.

There are many drawbacks of session ID and it may not be enough to fulfill some security requirements. (TO DO: discuss.)

Many developers use other logic to identify the session. (TO DO: expand.)

Examples of the names that some programming languages use when naming their cookie include:

* JSESSIONID ([[Java Platform, Enterprise Edition|Java EE]])
* PHPSESSID ([[PHP]])
* and ASPSESSIONID ([[Microsoft]] [[Active Server Pages|ASP]])

== See also ==

* [[Computer science]]
* [[HTTP]]
* [[HTTP cookie]]
* [[Session (computer science)]]
* [[Session management]]
* [[Stateless protocol]]

== External links ==

* [https://en.wikipedia.org/wiki/Session_ID Session token]

← Older revision		Revision as of 02:58, 26 April 2016
Line 53:		Line 53:

	* [https://en.wikipedia.org/wiki/Session_ID Session token]		* [https://en.wikipedia.org/wiki/Session_ID Session token]
		+
		+
		+	[[Category:Computer science]]
		+	[[Category:Computing]]
		+	[[Category:Web design and development]]

@@ Line 48: / Line 48: @@
 * [[Login session]]
 * [[Session (computer science)]]
 * [[Stateless protocol]]

@@ Line 44: / Line 44: @@
 * [[Computer science]]
 * [[HTTP cookie]]
 * [[Login session]]
 * [[Session (computer science)]]

@@ Line 46: / Line 46: @@
 * [[HTTP]]
 * [[HTTP cookie]]
 * [[Session (computer science)]]
 * [[Session management]]

Session token - Revision history

Karl Jones: /* External links */

Karl Jones: /* See also */

Karl Jones: /* See also */

Karl Jones: /* See also */

Karl Jones: Created page with "In computer science, a '''session identifier''', '''session ID''' or '''session token''' is a piece of data that is used in network communications (often over HTTP) to..."