There is a web application and I am looking at the cookies values after authentication using Burp proxy. There are 5 different cookies, say c1, c2, c3, c4, c5.

When I tampered with the values of c1, c2 and c3, I got a 200 OK response, meaning these cookies don't hold session information.
When I tampered the values of c4 and c5, I got a 302 response and was redirected to the login page. It means that c4 and c5 are session ID's.

My questions are:

  1. Is my understanding right about the site maintaining more than one session ID?
  2. Why would multiple sessions ID's be maintained? Is it to add some security?


It is very common to ensure the session cookie integrity. One way is to create a very random (reasonable long) identifier, another way is to sign the session cookie. It is even a MUST with the stateless systems, where the cookie passes the whole user context (very popular today).

So - you can have a cookie containing its signature within (such as JWT token) or another cookie containing MAC of the session cookie. If you fiddle with one of them, the session information becomes invalid.

It may have different reasons as well, such as you've changed the validity information, site-location information, ...

  • I also saw that in one of URL after authentication, one of the session ID passed through the URL as a parameter. If it were the only session ID, stealing session would have been easy. Multiple session IDs help with that, I guess. – one Jul 6 '16 at 9:31
  • You may have different sessions enroute, such as application session itself, session for the access manager / proxy, ... – gusto2 Jul 6 '16 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.