How exactly sessions and cookies combination , identify the correct user when a request send to the server

Question

Hi I know that sessions are in the server side , when a user logged into a site we create a session and store user data in that session , and that session ID is a unique one . if multiple users logged in to the same server sessions with unique session Id’s are created .

cookie is a small file that the server embeds on the user's computer. Each time the same computer requests a page with a browser.

in the browser cookie I have seen variables called SID and SSID are those referring to servers session ID ???

or

from what parameters of the cookie , session identify this is the correct user.

**when I send a request to the server

are those id's in cookie matched with the server session id ?

my question is how the server knows this is the correct user ??

I have the idea of sessions and cookies , but there combination in not clear .

actually I have searched this for very long time , and i asked my friends and they also seems they don't have a clear picture of this

please explain the scenario , thanks in advance.

Answer 1

That's the point, the server can't know this.

More in detail:

The server generates a unique id, then this is id is send to the client and the client stores this id in his cookies, for every request the client sends his id so the server knows which session he has to take for this user but the problem is, if someone else knows the id because he's listening the network traffic, he can use the session id and the server thinks, it's the same client as before and he'll take the same session as before. This is called Session hijacking

To prevent this, you have to store the ip address for each session key and check if they match but event then it's not 100% sure because if the client is in a NAT secured network and the attacker is in the same network too, they'll have the same IP address for the server and the server can't distinguish the attacker and the client.

Follow this tutorial to make your sessions safer.