I'm learning session management and I have two questions for which I could not find answers on the web.
Once the user is authenticated, the server creates the Session ID and sends it to the client (user) in the form of a cookie. This cookie is then subsequently used in requests the client sends to the server to identify himself among other users.
Now in a HTTPS session, the requests sent between the client and server are secured, as requests from the client are encrypted using the public key of the server, and it can only be decrypted using the private key which the server only has.
But initially when the server sends the cookie information to the client, it could be intercepted by anyone as even if this cookie which contains the session ID is encrypted using the private key. It could be decrypted by anyone having the public key. So, my question is:
How does the server make sure that the session ID created by the server is securely sent to the client.
I learnt that the client sends the cookie for each request it makes to the server. In a GET request, how does the client send the cookie information, as GET does not include the body?