Is User Authentication mechanism of Session Tracking

[kkchaitanya_18]

Is User Authentication mechanism of Session Tracking ?

[sk_kireeti]

Even though session trackings main intension is not user authentication, indirectly it helps for user authentication also.

Thanks,
Krishna

[kkchaitanya_18]

But it was not clear bcoz some textbooks says the user authentication is one of the method in session tracking
I want clear explaination to each and every method in session tracking
can any one reply to this?

[sk_kireeti]

Chaitanya,

Here is a simple scenario how session tracking can be used for user authentication.

Let us assume we are generating a valid session id when ever a user is logging into the application or site. For all subsequent requests, we use the same session id to identify the user. At any point of time, if you don't see any valid session id in the request, we can assume that either session is either expired or the user is not logged in. Then force the user to login (again) and generate valid session id. Thus we can indirectly use session ids to implement authentication. But this is not fully secured mechanism. This provides security only to limited extent.

Thanks,
Krishna

[kkchaitanya_18]

Thank you for your explaination keeriti