Session Cookie

A website normally forgets, after every click, who exactly is browsing it. For the server, meaning the computer delivering the page, every page request is a new event with no memory. For this to work anyway, the site stores a tiny text file in the browser. This file is called a cookie and usually contains nothing more than a long, random string of characters. A session cookie is the variant of this that only applies to the current visit. Once you close the browser window, it disappears again.

Without it, every click would be a fresh start

This is most noticeable when shopping online. You put shoes in the shopping cart, click through to the jackets, and the cart is still full. That is exactly what the session cookie accomplishes. It tells the server with every click: this is the same visitor as before.

The same applies to any login. After entering a username and password, the server generates a session key and stores it as a session cookie. With every further page, the browser automatically sends this key along. Without it, you would have to log in again on every single subpage.

It is important to distinguish this from a persistent cookie. Such a cookie has an expiration date and remains stored for weeks or years. This allows a user to be tracked across many visits, which is of interest for advertising. Session cookies, by contrast, are considered relatively harmless. That is why technically necessary session cookies in the EU may generally be set without consent.

The key in the browser, the data on the server

A good comparison is the coat check at a theater. You hand over your jacket and receive a number on a ticket. The ticket is the session cookie, the jacket is the data on the server. The ticket says nothing about the jacket, just a number. Whoever holds the ticket gets the jacket.

Technically, this is how it works: with its first response, the server sends along a line containing the session number. The browser stores it in memory, not on the hard drive. With every subsequent request to the same site, it automatically attaches it. The server looks up the matching session and knows the context again.

This also gives rise to the greatest danger. Whoever steals the session number can impersonate the user, entirely without a password. This is called session hijacking. Encrypted connections and flags that forbid access by foreign scripts help against this. In addition, sessions automatically expire after some time without activity.

Cookie banners, online banking, and the hassle with tabs

The term is most commonly encountered in cookie banners. There, session cookies are almost always listed under the necessary cookies that cannot be deselected. The reason is simple: without them, the site could not be used sensibly at all. The checkboxes that can be declined, on the other hand, usually concern advertising and analytics cookies with a long lifespan.

In online banking, session cookies are especially short-lived. After just a few minutes without a click, you are automatically logged out. This is not harassment, but deliberate design. The shorter a session remains valid, the less use a stolen key is.

A common misconception is the assumption that a session cookie contains personal data. As a rule, it contains nothing but a random number. The idea that multiple tabs are separate sessions is also incorrect. All tabs of the same browser share the cookie. Anyone wanting to use two accounts at the same time therefore needs a private window or a different browser.