A session ID is a way in which a computer system, typically a server, is able to identify and track the actions of a single user during any particular session. These are used quite extensively on the Internet by a variety of websites, and various methods can be used, such as cookies or uniform resource locators (URLs) specifically intended for tracking them. By using these identifiers, a system is able to more easily track the users currently connected to the system, and provide information relevant to each user. A session ID is typically generated at the start of a session and is unique to a given user during that session.
Also called a session identifier, a session ID is a numerical or alphanumerical code given to a user connected to a computer system, such as a website server. This code is then used during a session to identify that user and allow him or her to have information specific to his or her use. For example, a shopping website might allow a user to add items he or she is interested in purchasing to a virtual “shopping cart.” This shopping cart would rely on the session ID of the user to track items that he or she adds, and keep each user’s carts separate.
By design, a session ID is typically generated when a user first visits a website, and this can be done in a number of different ways. This is often done through a random number generator to more effectively avoid hackers who may attempt to falsely use someone else’s identifier. Hackers or other users attempting to launch some form of attack on a system can use a method called “session prediction” to try to determine the identifier of someone else, and then perform “session hijacking” to use the identifier and appear like another user to that system. More specific information can be used to generate a session ID, however, such as the date or time a user begins a session, ensuring the identifier remains unique for different users.
A session ID is typically only valid for a single session of use, though this can be defined in different ways on different systems. In general, a session begins when someone navigates to a webpage and ends when the user leaves the page. Some systems are designed with a time out function that will end a session after a set period of time of inactivity passes, often around 10 minutes. Other systems will even recognize a session ID after the user navigates away from the webpage and then returns, as long as the user has not closed his or her Internet browser program.