It is difficult for me to fully understand this whole process.
I am using express.js and express-session.js with Node.
Now if someone logs in, a session is stored in the session store(server side) and as a cookie (client side).
Besides other configuration options, there is:
my session name is : 'session_ID' and the secret is : 'secret' (*just for this demonstration*)
Example: Server side-> Store:
Now the value of the cookie is the following:
I know that
s%3 is some kind of prefix
then there is the sessionId:
and the last thing after the dot (.):
So correct me if I am wrong but my assumption is:
the sessionID is long enough so it will be safe against bruteforcing a right sessionID and logging in as someone else.
If a client sends a request with the cookie, I can get his data from the session store (here it would be the userId) and make decisions based on that.
So what is the thing after the dot?
Why do I need a secret?
EDIT (as advised by Xander not to do it by an answer):
Okay, what I could have done before asking this question here is just try it out. So I opened two browser B1 and B2.
In B1 I logged in as User1 and in B2 as User2. I have a query where i get the current User.
So I took the session ID of User1 of B1 and replaced it with User2 of B2 and made a query to get the current User -> What I got was no User.
So the assumption of me was wrong.
Is there a helpful site which explains this? I still don't get how this really works "behind the scences".