There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different users. All three gets same cookie values(including WSS_KeepSessionAuthenticated which I suspected to be a session cookie) and I am really confused seeing it!
I deleted manually all three cookies. But WSS_KeepSessionAuthenticated gets automatically generated and the session is kept alive. This happens till the browser is kept open.
How is session being managed here? It seems cookies have whatsoever no role in managing a session. Then how the server is recognizing the users?