# Generating Sessions Ids

DevFeed: [Generating Sessions Ids](<https://devfeed.tech/articles/generating-sessions-ids-24931.md>)

Original publisher: [Read original article](<https://codeahoy.com/2016/04/13/generating-session-ids/>)

Author: umer

Published: 2016-04-13T00:00:00Z

Content type: tutorial

Language: en

Sources: [Code Ahoy - Articles](<https://devfeed.tech/sources/code-ahoy-articles.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [algorithm](<https://devfeed.tech/tags/algorithm.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [http](<https://devfeed.tech/tags/http.md>), [ids](<https://devfeed.tech/tags/ids.md>), [rest](<https://devfeed.tech/tags/rest.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [stateless](<https://devfeed.tech/tags/stateless.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This tutorial explains how session IDs let servers identify users over stateless HTTP. It describes their required properties--uniqueness, limited lifetime, and unpredictability--and discusses random session IDs, entropy, cookies, and security considerations.

## Source excerpt

Session Id's are unique, short-lived numbers that servers assign to users when they log in (or visit) so they can remember (or track) users for the duration of their sessions. Servers use session Id's to remember users because the underlying protocol, HTTP, is stateless. Once they receive session Id from the server, users send it back in the following requests to identify themselves. For example, when you login to a website, the server assigns you a session Id and sends it to your browser wrapped in a cookie. The browser automatically sends the cookie back in the subsequent requests so the server knows who is making the request. Almost all web frameworks I have worked with have built-in support for sessions: they generate and assign Id's under the hood. The only time I had to generate session Id's manually was when I was building a REST application (game service) that needed a custom way to identify users and sessions. This blog post is the result of research I had to do to build that feature. I would highly recommend not rolling out your custom session handling code, unless you absolutely have to. Session Ids are unique, transient and non-guessable Session Id's must be unique across all users. Can you imagine two people getting assigned the same Social Security number? That would be a disaster. Session Id's have 'best-by' date and they timeout after a certain period. If they didn't, a hacker could steal and use them indefinitely. Generally the expiry period ranges from minutes to weeks. High-risk applications expire session Ids more frequently than the low risk ones to minimize the attack window. Session Id's are not guessable. A bad example would be an algorithm that generates sequential session Id's. Hackers can easily identify patterns and hijack user sessions. You can generate and assign session Id's to users in many different ways. I'll discuss three common methods below. 1. Random session Ids Random session Id's have no meaning by virtue of being completely r