Session Token.

A session token is the credential that keeps a user logged in across stateless HTTP requests. Most commonly it is a cryptographically random string stored on the server side (in a database, cache, or signed cookie) and sent to the browser as a cookie marked Secure, HttpOnly, and SameSite. The server uses it as a key into session storage holding the user ID, roles, and metadata.

The OWASP ASVS and Session Management Cheat Sheet recommend session identifiers carry at least 64 bits of effective entropy (a ~128-bit random value), be regenerated on login and privilege change to defeat session fixation, and enforce idle plus absolute timeouts with server-side invalidation at logout. Because a stolen token often bypasses passwords and even MFA, session theft is a favoured attacker technique: Eric Butler's 2010 Firesheep extension trivially "sidejacked" cookies over open Wi-Fi, accelerating the industry move to HTTPS-everywhere, and modern info-stealer malware (RedLine, Lumma) harvests live session cookies to hijack accounts. Binding tokens to context — HttpOnly to block JavaScript theft, SameSite to blunt CSRF, TLS to stop network capture, and optionally token binding or device fingerprints — limits replay. Common failure modes include predictable IDs, tokens exposed in URLs, and sessions that never expire.

flowchart LR
  A[User authenticates] --> B[Server generates<br/>high-entropy token]
  B --> C[Set-Cookie: Secure;<br/>HttpOnly; SameSite]
  C --> D[Browser stores cookie]
  D --> E[Token sent on<br/>each request]
  E --> F[Server looks up<br/>session state]
  F --> G[Logout / timeout:<br/>invalidate server-side]