- Session id cookie is always sent back to client in response - When no cookie is sent in as a request, a new session id is created