I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?
closed as off topic by AJ Henderson, Luc, lynks, Gilles, user2213 Apr 26 '13 at 17:30
Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.
"Session ID" is a general concept used in many places. It is "a name for a session". Whenever you have a session and you want to designate it (e.g. in a message in a network protocol), whatever you use to designate it is the "session ID". It can contain any characters or bytes that the said protocol says it can contain.
Every protocol is free to define things at it sees fit. In the case of SSL, for instance, there is a notion of "session", and the "session identifiers" used by the protocol are sequences of 1 to 32 bytes (all byte values from 0 to 255 are acceptable, but there shall be no more than 32 such bytes). In the case of PHP, which also has a notion of session, the "protocol" is an agreement between PHP, the site code and a PHP module called the "session handler"; there, session ID are sequences of characters, and the session handler can enforce some limitations, which depend on the specific session handler in force.