Cookie and SessionId

[barun]

Can I know the detailed difference between a cookie and a session Id. Who set them?

[coopster]

They are both used to store/retrieve information from the client side of the connection. Sort of like using hidden fields in an HTML form to maintain some form of state throughout the browsing session. Here is the original and still "official" spec on cookies [wp.netscape.com].

[Otaku]

When a visitor comes to your site, your server (running some scripting engine) says: "OK, I got another visitor. I do already have fifty, so this one will be 51st. Gotta record it somewhere, not to get confused..." The server may record it in various ways. For example, it can create a temporary file with the number as a name, and store all stuff about that particular visitor in the file.
This is called a Session ID (SID). This is an identificator of a particular visitor that browses the site at the moment.

The server also stores the SID in the visitor's browser. When the server sends the first page of the site to the visitor, it sends the SID along with it. It says: "Here's your page dude, and by the way, you're the visitor number 51 currently, don't forget it, OK?"
This is called a cookie.
The browser stores the cookie somewhere on the visitor's computer. For example, Internet Explorer saves them in C:\Documents and Settings\Username\Local Settings\Temporary Internet Files.

When the visitor wants to view another page on the same site, the browser requests it from the server, and passes the cookie along with the request. "Hey dude, gimme that page please... Oh, and by the way, I'm the visitor 51, hope you didn't forget me :)"
The server receives the request, the cookie and thinks: "Wow, seems like I know this guy! He asks for the second page already! OK, he gets it..." and all the following server actions are done according to the "memory" that he has about that particular user.

Hope you get it :)

[barun]

Otaku, Thats a great explanation indeed. Thx.

[Otaku]

You're welcome :)

I re-read what I said above and would like to add that though cookies are often used for storing SessionIDs, they aren't only for that. They are a general mechanism for storing something on a visitor's machine (in browser). Any strings.

The Opera browser (my favourite :) has a grat feature of showing all cookies that a site sent you. On any page, just hit F12 / Edit site preferences... / Cookies - you'll see the list and will even be able to edit/delete them.

BTW, your server might even know nothing about cookies - you can set them later, when a page is already loaded into the visitor's browser, with JavaScript. Google for "javascript set cookies" and you must find the tutorial from W3Schools.

So cookies are a standard. While SessionID is more an abstract term, and every webmaster decides himself how to implement the "memory".

[edited by: Otaku at 7:31 am (utc) on Feb. 27, 2008]