How does a web application install session IDs on a browser?

• A. By embedding the session ID in the page content
• B. By using a URL parameter
• C. By using session cookies
• D. By TLS session resumption

Answer: (C)

The browser gets a session ID through cookies. When the server authenticates you, it creates a session on the server and sends the ID in an HTTP Set-Cookie header. The browser stores that as a cookie (usually a session cookie with no expiration) and automatically includes it in subsequent requests to the same site via the Cookie header. This lets the server map each request to your active session and retrieve your state.

Embedding the ID in page content is insecure and brittle, since the ID would appear in the HTML and depend on manual extraction. Using a URL parameter would expose the ID in links, history, and logs, making it easy to leak. TLS session resumption is a transport-layer optimization, not a method for maintaining application state with a browser.