Learning more about Drupal core so I can be a better contributor, understand security better, etc.
I noticed that on creating a session Drupal uses both an "sid" and "ssid" field. The code seems to indicate they are both the same (the little code I've been able to decipher so far),
'sid' && 'ssid' = session_id(), and looking at the DB only the sid is set in my own session.
Why do both columns exist? Is it a security measure? If so what does it do? Is it a legacy field from an old system?
Looking at Drupal 7 code.