Learning more about Drupal core so I can be a better contributor, understand security better, etc.

I noticed that on creating a session Drupal uses both an "sid" and "ssid" field. The code seems to indicate they are both the same (the little code I've been able to decipher so far), 'sid' && 'ssid' = session_id(), and looking at the DB only the sid is set in my own session.

Why do both columns exist? Is it a security measure? If so what does it do? Is it a legacy field from an old system?

Looking at Drupal 7 code.

1 Answer 1


Yes it is a security measure; sid is the session id for HTTP traffic & ssid is the session id for HTTPS traffic. The idea here is that secure parts of your website (e.g. https://www.example.com/user/*/edit ) can't be compromised by session hijacking the sid that occurs with HTTP traffic.

  • Ah yes. I see the code now that I know what I'm looking for. I always new the whole http/https shared session thing was magicy. This makes sense. Commented Jul 8, 2015 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.