As is stated in this question:
Two-factor or multi factor authentication is based on three possible forms of authentication:
Something you know which is considered secret (password)
Something you have (token, SMS token, card,...)
Something you are (biometrics)
Given that a session ID is obtained after a successful authentication, could it be considered as "something you have" obtained from "something you know" (e.g. user/password)?
For example, if I want to authorize a specific operation by using biometrics, would be the pair ("session ID","biometrics") be considered as a valid two-factor authentication?