There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such.

Would someone help me understand what goes on in server and what happens to session IDs and login info? (saved in a cookie file)

I enter my username and pass, a cookie is saved to my PC named PHPSESSID. It contains a 32 character hash (MD5?) It says it expires when session ends. If I logout and login again (even using the same username) this hash changes. Needless to mention, logging in with other usernames also makes this hash change.

  1. If this hash is made from my username and pass, why it changes?
  2. Is the subject of salts related to my question?
  3. If salts are used in generating this hash, and if salts are random, how the server side compares the hashes in their database, to the hash made from my user/pass+random salt?

It seems my questions are quite far apart in category, sorry about that.

This website I'm talking about has a history of mixed logins (though rare). Like when I login using my username/pass I accidentally go to another users session.

Where is the security weakness of this procedure? (which probably is the reason for the mentioned mixed-session logins)

  • Why do you think that the hash is made from your username and password? That would be a really poor session identifier. Most session hashes should be essentially random and unpredictable - there are lots of questions about generating session identifiers on this site.
    – Matthew
    Jan 2, 2017 at 11:52
  • thanks for your response, I edited my question and added the last question, any idea about that ? Jan 2, 2017 at 11:59

1 Answer 1


A session is data stored on the server corresponding to some client. To know which data to access, the client gets a cookie with a session identifier. The value of this identifier is not meaningful, it is just a token to obtain the correct data. For example, if your session identifier is abcd1234, the server will look in /var/sessions/abcd1234.txt for the session data.

The session identifier you mention is likely randomly generated and not derived from the username, password, or salt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .