For websites with membership systems, after users
login the systems,
websites will automatically create
Session ID [1] of users and use it as a reference code
in order to know that to whom the systems are communicate with.
For example, when the Browser
sends an HTTP Request to a website, the website will
know who the user is.
This process is done by bringing
Session ID inside the HTTP Request to check. Session
ID is usually kept in a Cookie, or sometimes (very
rarely) it is sent via Hidden Field. However, if the
HTTP Request is sniffed, the Session ID will also be
sniffed
(although the Session ID is in a Cookie or
Hidden Field).