There is a web application and I am looking at the cookies values after authentication using Burp proxy. There are 5 different cookies, say
When I tampered with the values of
c3, I got a 200 OK response, meaning these cookies don't hold session information.
When I tampered the values of
c5, I got a 302 response and was redirected to the login page. It means that
c5 are session ID's.
My questions are:
- Is my understanding right about the site maintaining more than one session ID?
- Why would multiple sessions ID's be maintained? Is it to add some security?