Session ID vs Session Token

-

 

In this post  we will see what is a session token and session ID.

Imagine, you are want to travel is a train and you buy a ticket. The ticket is valid for a certain amount of time. You can travel any number of times as long as the ticket is valid. 

Ticket is the "Session Token".

Let's compare with distribute systems.



When you login to the banking website, it prompts the user to enter with "Username: and "Password".

Upon successful authentication, the authentication server generates a session token.

This session token is valid for a certain amount of time.

With this token, the user can make future requests in the banking site like checking balance, fund transfer. Once the token is expired, the user must "Re-Authenticate".

Then, What is Session ID?

When a user log to the banking website, server create a session token post verifying credentials.

Then, the server creates a session ID.

Server stores the token inside the session data.

Server gives the client the session ID(usually in a cookie).

session_id = "session123"

Redis["session123"] = {
    user_id: 100,
    session_token: "f9a2c1e4b8d9a7c3e12f4ab9c88d1aa",
    expires: "2026-09-11T18:00Z"
}

When the client makes a request, the cookie (Session ID) must be passed.

So, when the server receives the request. It validates in a specific and predictable sequence.

Client send a GET request with Session ID

GET /welcome/<username>

Cookie: session_id=session123

Server extracts the cookie header.

session_id = "session123"

Then, the server looks up the session ID in the session store (Redis/Memcache/Hazzlecast)

If the session_id exist, it checks the "expires". If valid, the request is processed by the application that serves /welcome/, else session is invalid.

I created a simple flask application to demonstrate the same.

When the user logs in, they need to pass the credentials.

On successful authentication, server create a session ID.


Now, When I make calk to the /welcome/alice, the session ID is passed and validated.


Session token mapped to this ID is valid for 1 min. After 1 min,









Comments

Post a Comment

Popular posts from this blog

Agentic AI - Series 3

-
Image
                                                                      In this blog we will see how to build a simple agent without using any LLM model. Simple flow of an agent: Agent takes input -> Based on the input, it decides which tool to use -> Performs operation and send the output back to the user. An AI agent framework is  a set of tools, libraries, and structures that simplifies building, deploying, and managing autonomous AI agents. But, here we are going to build an agent without using any framework and LLM's. Agent functionality is to perform "Addition" and "Subtraction". Agent uses 2 python functions (Tools) to perform addition and subtraction operations. Finally, it send the output to the user. We are going to implement the above discussed functionality vi...
Read more

Agentic AI - Series 4

-
Image
                                                                   In this blog, will how to create a simple agent using AI framework like Langchain with a simple LLM model  gpt-4o-mini. from langchain_openai import ChatOpenAI from langchain_core . tools import tool import os # Creating a tool @ tool def add_numbers ( x : int , y : int ) -> int :     "Add two numbers"     return x + y @tool is a decorator to define a tool. This is a simple tool to add 2 numbers. The below line creates a Langchain LLM wrapper around on the OpenAI chat mode 'gpt-4o-mini' # Binding the tool to a model llm = ChatOpenAI( model = "gpt-4o-mini" ).bind_tools([add_numbers]) response = llm .invoke( "What is 5 + 7?" ) When we print response, is the expected outcome? Is it 12. NO...
Read more

S3 - Directory Bucket

-
Image
  Directory buckets organize data hierarchically into directories as opposed to the flat storage structure of general purpose buckets. There aren't prefix limits for directory buckets, and individual directories can scale horizontally. Directory buckets support bucket creation in the following bucket location types : Availability Zone or Local Zone. For low latency use cases, you can create a directory bucket in a single Availability Zone to store data. Amazon S3 Express One Zone is a high-performance, single-zone Amazon S3 storage class that is purpose-built to deliver consistent, single-digit millisecond data access for your most latency-sensitive applications.  S3 Express One Zone is the lowest latency cloud-object storage class available today, with data access speeds up to 10x faster and with request costs 50 percent lower than S3 Standard. With S3 Express One Zone, your data is redundantly stored on multiple devices within a single Availability Zone.   You can ac...
Read more