Explanation via Pictures:
You can think of a session kinda like a library ID card. Everytime you go to a library, then you you show them your ID card which was issued by that particular library. Now they can match up who you are with the records stored on file.
Let's elaborate step-by-step:
Simple Explanation by analogy
Imagine you are in a bank, trying to get some money out of your account. But it's dark; the bank is pitch black: there's no light. You are surrounded by another 20 people. They all look the same. And everybody has the same voice. And everyone is a potential bad guy. In other words, HTTP is stateless.
This bank is a funny type of bank - for the sake of argument here's how things work:
- you talk to your teller and make a request to withdraw money, and then
- you have to wait briefly on the sofa, and 20 minutes later
- you collect your money from the teller.
But how will the teller tell you apart from everyone else?
The teller can't see or readily recognise you, remember, because the lights are all out.
What if your teller gives your $10,000 withdrawal to someone else - the wrong person?! It's absolutely vital that the teller can recognise you as the one who made the withdrawal, so that you can get the money (or resource) that you asked for.
Solution:
When you first appear to the teller, he or she tells you something in secret:
"When ever you are talking to me," says the teller, "you should first identify yourself as GNASHEU329 - that way I know it's you".
Nobody else knows the secret passcode.
Example of How I Withdrew Cash:
So I decide to go to and chill out for 20 minutes and then later I go to the teller and say "I'd like to collect my withdrawal"
The teller asks me: "who are you??!"
"It's me, Mr. George Banks!"
"Prove it!"
And then I tell them my passcode: GNASHEU329
"Certainly Mr. Banks!"
That basically is how a session works. It allows one to be uniquely identified in a sea of millions of people. You need to identify yourself every time you deal with the teller.
Difference between Sessions and Cookies
Cookie: You can think of a cookie as simply plastic card upon which information is printed on. You can store anything on that card, like:
- name / age / sex / marital status
- passcodes
Sessions: Think of it like a temporary passcode. The passcode is stored in the cookie but it that does not make it a cookie. You wouldn't want anyone to be able to easily tamper with people's passcodes, or to be able to easily reproduce it - see below for examples:
Security Concerns with Cookies
The bank can write information onto your card - and so can you. But this can be dangerous:
name: Ben Koshy
sex: male
bank balance: $1.99 :'(
If I wanna be sneaky, I could edit my ID card:
name: Ben Koshy
sex: male
bank balance: $1 billion bucks. <------ new line
Hooray! I could print more money than Yellen and Powell combined. This presents a security risk: it is for this reason that banks "encrypt" information on cookies, so that if you tampered with it, the bank would know. As a general rule you should never put anything compromising, that can be tampered into a cookie - the bank balance should be stored on the server, where nobody can directly tamper with it.
In this case, Powell decided to tamper with bank balance in his cookie. The bank can now invalidate his session, and log him out - permanently:
name: Jerome Powell
title: "independent" bureaucrat
skill: lying to congress;.
session: tampering with the Fed's balance sheet,
lying to congress, criminal incompetence
-> session invalid. log him out the fed, permanently.
Good bye sir!
Duplicating Sessions
Think of any web-based service: facebook, gmail: if I have your password, then I get access to your account. It's the same with sessions: if I can reproduce or recreate your session, then I can impersonate you. This might happen if you get really sloppy / careless and accidentally release your private key on the internet. Someone in Github quite recently (February 2023) released some private keys. If they released Github's secret_base_key, which is some random number in their Rails application, then I could use that private key to create sessions. And once I create a session, I could effectively impersonate someone else.
