What is a session token in web session management?

What is a session token in web session management?

• A. A unique identifier used to track a session between a web browser and a webserver
• B. A password for admin access
• C. An encryption key for the session
• D. A digital certificate

Answer: (A)

A session token is a unique identifier that lets a web server recognize a user’s ongoing session with a particular browser. When you log in, the server creates this token and gives it to the browser (usually via a cookie). With every subsequent request, the browser sends the token back, so the server can look up the associated session data—like who you are, what you’re allowed to do, and any temporary preferences—without asking you to re-enter credentials each time. This is different from a password (which is a secret used to prove identity), an encryption key (which protects data), or a digital certificate (which proves identity in a cryptographic handshake). The token’s job is simply to maintain access to the session state across requests. For security, tokens should be unpredictable, have an expiration, be rotated after sensitive actions, and be stored in secure cookies (HttpOnly and Secure) to reduce exposure to theft.

A session token is a unique identifier that lets a web server recognize a user’s ongoing session with a particular browser. When you log in, the server creates this token and gives it to the browser (usually via a cookie). With every subsequent request, the browser sends the token back, so the server can look up the associated session data—like who you are, what you’re allowed to do, and any temporary preferences—without asking you to re-enter credentials each time. This is different from a password (which is a secret used to prove identity), an encryption key (which protects data), or a digital certificate (which proves identity in a cryptographic handshake). The token’s job is simply to maintain access to the session state across requests. For security, tokens should be unpredictable, have an expiration, be rotated after sensitive actions, and be stored in secure cookies (HttpOnly and Secure) to reduce exposure to theft.