Overview
The session identifier is the value that ties a request to a user's session — effectively the key to their account. Its security properties (randomness, secrecy, lifecycle) determine whether sessions can be attacked. This lesson focuses on session identifiers.
Learning objectives
- Explain what a session identifier is and why it must be unpredictable.
- Describe requirements for secure session IDs.
- Connect weak identifiers to hijacking and fixation.
Core concept
A session identifier (session ID) is the token that represents a session, typically stored in a cookie. Because possessing it grants access to the session, it must be:
- Unpredictable — generated with a cryptographically secure random source, long enough to resist guessing/brute force.
- Unique — not reused across users or sessions.
- Secret — protected in transit and from theft.
- Rotated on privilege change — e.g. regenerated at login to prevent fixation.
How it works
The server issues a random session ID and maps it to the user's session. Its unpredictability is what stops an attacker from guessing valid IDs; its secrecy (protective cookie flags, HTTPS) stops theft; and regenerating it at login stops an attacker from fixing a known ID onto a victim before they authenticate (session fixation). If any of these fail — a predictable ID, a leaked ID, or a non-rotated ID — the session can be taken over.
Practical example
A secure app issues session IDs like a long, random string from a secure generator, and regenerates the ID the moment a user logs in. If instead IDs were sequential or short, an attacker could guess or brute-force valid sessions; and if the ID were not regenerated at login, an attacker who planted a known ID beforehand would share the victim's authenticated session (fixation). Strong randomness plus regeneration close both gaps.
Cybersecurity relevance
Session identifiers are the linchpin of session security. Predictable IDs enable guessing/brute-forcing of active sessions; leaked IDs (via XSS, insecure transport, or logs) enable hijacking; non-regenerated IDs enable session fixation. Testers examine ID randomness, transport protection, and whether IDs rotate at login/logout. Defenders use secure generation, protective cookie flags, HTTPS, and regeneration on authentication and privilege changes.
Common mistakes
- Using predictable or short session IDs (sequential, timestamp-based), enabling guessing.
- Not regenerating the session ID at login, leaving the app open to fixation.
- Leaking IDs via URLs, logs, or scripts (relates to cookie flags and XSS).
Key takeaways
- A session identifier is the key to a user's session; it must be unpredictable (secure randomness), unique, secret, and regenerated at login.
- Weak identifiers enable session hijacking (guessing/theft) and session fixation (planting a known ID).
- Secure generation, protective transport/flags, and rotation on authentication defend session identifiers — standard assessment checkpoints.
Check your understanding
- Why must session identifiers be generated with a cryptographically secure random source?
- How does regenerating the session ID at login prevent session fixation?