When is the session id/authentication token generated when accessing certain sites?
The question title doesn't do a very good job at explaining what exactly my question is, so I'll elaborate:
When accessing most websites (in this question I'll just use twitter.com as an example), the first request that is made is to the website URL:
Even though this is the first time the client connects to the server (as far as I know) the request headers still contain a ton of information, including a session token:
How can this token be generated despite the client not having any previous contact with the server? (Again, as far as I know.)
I apologize if I'm missing something basic and fundamental, but I'm having a hard time trying to wrap my head around how this is possible.
networking cookies session
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
asked Dec 14 at 4:08
Sam R.
31
add a comment |
The question title doesn't do a very good job at explaining what exactly my question is, so I'll elaborate:
When accessing most websites (in this question I'll just use twitter.com as an example), the first request that is made is to the website URL:
Even though this is the first time the client connects to the server (as far as I know) the request headers still contain a ton of information, including a session token:
How can this token be generated despite the client not having any previous contact with the server? (Again, as far as I know.)
I apologize if I'm missing something basic and fundamental, but I'm having a hard time trying to wrap my head around how this is possible.
networking cookies session
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
asked Dec 14 at 4:08
Sam R.
31
add a comment |
The question title doesn't do a very good job at explaining what exactly my question is, so I'll elaborate:
When accessing most websites (in this question I'll just use twitter.com as an example), the first request that is made is to the website URL:
Even though this is the first time the client connects to the server (as far as I know) the request headers still contain a ton of information, including a session token:
How can this token be generated despite the client not having any previous contact with the server? (Again, as far as I know.)
I apologize if I'm missing something basic and fundamental, but I'm having a hard time trying to wrap my head around how this is possible.
networking cookies session
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
asked Dec 14 at 4:08
Sam R.
31
The question title doesn't do a very good job at explaining what exactly my question is, so I'll elaborate:
When accessing most websites (in this question I'll just use twitter.com as an example), the first request that is made is to the website URL:
Even though this is the first time the client connects to the server (as far as I know) the request headers still contain a ton of information, including a session token:
How can this token be generated despite the client not having any previous contact with the server? (Again, as far as I know.)
I apologize if I'm missing something basic and fundamental, but I'm having a hard time trying to wrap my head around how this is possible.
networking cookies session
networking cookies session
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
asked Dec 14 at 4:08
Sam R.
31
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
asked Dec 14 at 4:08
Sam R.
31
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
edited Dec 14 at 8:01
Ahmed Ashour
1,066610
1,066610
asked Dec 14 at 4:08
Sam R.
31
asked Dec 14 at 4:08
Sam R.
31
asked Dec 14 at 4:08
Sam R.
31
31
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Cookies are stored in your browser. The browser just sends back the cookies to the server that it got from the server. On the (actual) first connection, there will be no cookies, including no session cookies (you can simulate that by deleting all the cookies in your browser). On subsequent connections, the browser will send the cookie it got the last time.
So in your example, you (or someone else) already used your browser to connect to Twitter. That's why the cookie is sent.
The cookies are always generated in the server of the website you are connecting to. They are never generated in your browser.
answered Dec 14 at 7:03
dirkt
9,03231121
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383470%2fwhen-is-the-session-id-authentication-token-generated-when-accessing-certain-sit%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Cookies are stored in your browser. The browser just sends back the cookies to the server that it got from the server. On the (actual) first connection, there will be no cookies, including no session cookies (you can simulate that by deleting all the cookies in your browser). On subsequent connections, the browser will send the cookie it got the last time.
So in your example, you (or someone else) already used your browser to connect to Twitter. That's why the cookie is sent.
The cookies are always generated in the server of the website you are connecting to. They are never generated in your browser.
answered Dec 14 at 7:03
dirkt
9,03231121
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
add a comment |
Cookies are stored in your browser. The browser just sends back the cookies to the server that it got from the server. On the (actual) first connection, there will be no cookies, including no session cookies (you can simulate that by deleting all the cookies in your browser). On subsequent connections, the browser will send the cookie it got the last time.
So in your example, you (or someone else) already used your browser to connect to Twitter. That's why the cookie is sent.
The cookies are always generated in the server of the website you are connecting to. They are never generated in your browser.
answered Dec 14 at 7:03
dirkt
9,03231121
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
add a comment |
Cookies are stored in your browser. The browser just sends back the cookies to the server that it got from the server. On the (actual) first connection, there will be no cookies, including no session cookies (you can simulate that by deleting all the cookies in your browser). On subsequent connections, the browser will send the cookie it got the last time.
So in your example, you (or someone else) already used your browser to connect to Twitter. That's why the cookie is sent.
The cookies are always generated in the server of the website you are connecting to. They are never generated in your browser.
answered Dec 14 at 7:03
dirkt
9,03231121
Cookies are stored in your browser. The browser just sends back the cookies to the server that it got from the server. On the (actual) first connection, there will be no cookies, including no session cookies (you can simulate that by deleting all the cookies in your browser). On subsequent connections, the browser will send the cookie it got the last time.
So in your example, you (or someone else) already used your browser to connect to Twitter. That's why the cookie is sent.
The cookies are always generated in the server of the website you are connecting to. They are never generated in your browser.
answered Dec 14 at 7:03
dirkt
9,03231121
answered Dec 14 at 7:03
dirkt
9,03231121
answered Dec 14 at 7:03
dirkt
9,03231121
answered Dec 14 at 7:03
dirkt
9,03231121
9,03231121
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
add a comment |
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Ahh, thanks. At first, I was confused, as the session id still showed up even after clearing cookies. That's when I realized that the chrome search autocomplete sends a request to the site (probably in order to get its icon). Clearing the cookies after entering in the full URL gave me the expected result.
– Sam R.
Dec 14 at 21:58
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
Yes, cookies will also be set when requesting the icon (if the server is programmed this way).
– dirkt
Dec 15 at 7:13
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383470%2fwhen-is-the-session-id-authentication-token-generated-when-accessing-certain-sit%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
