Is there a list of names for cookies carrying SID's? For instance:

  • PHP by default uses PHPSESSIONID
  • Tomcat uses JSESSIONID
  • ...

I would like to be able to intercepts all SID's supplied via Cookies, of websites I visit. I could use heuristics like:

  • HttpOnly attribute set
  • Secure attribute set (not always the case)
  • The name contains the string "ID" or "SESSION"

Has anyone done this kind of research before?


  • 1
    Many frameworks allow you to specify the session cookie name. You'll never be able to get those. – Neil Smithline Dec 5 '15 at 14:37
  • 2
    How are you planning on intercepting? What are you trying to achieve? – Neil Smithline Dec 5 '15 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.