Session hashes - how it works?

Question

There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such.

Would someone help me understand what goes on in server and what happens to session IDs and login info? (saved in a cookie file)

I enter my username and pass, a cookie is saved to my PC named PHPSESSID. It contains a 32 character hash (MD5?) It says it expires when session ends. If I logout and login again (even using the same username) this hash changes. Needless to mention, logging in with other usernames also makes this hash change.

1. If this hash is made from my username and pass, why it changes?
2. Is the subject of salts related to my question?
3. If salts are used in generating this hash, and if salts are random, how the server side compares the hashes in their database, to the hash made from my user/pass+random salt?

It seems my questions are quite far apart in category, sorry about that.

This website I'm talking about has a history of mixed logins (though rare). Like when I login using my username/pass I accidentally go to another users session.

Where is the security weakness of this procedure? (which probably is the reason for the mentioned mixed-session logins)

Answer 1

A session is data stored on the server corresponding to some client. To know which data to access, the client gets a cookie with a session identifier. The value of this identifier is not meaningful, it is just a token to obtain the correct data. For example, if your session identifier is abcd1234, the server will look in /var/sessions/abcd1234.txt for the session data.

The session identifier you mention is likely randomly generated and not derived from the username, password, or salt.