Why does Drupal have both "sid" and "ssid" field in the session?
Yes it is a security measure; sid is the session id for HTTP traffic &amp;  ssid is the session id for HTTPS traffic. The idea here is that secure parts of your website (e.g. https://www.example.com/user/*/edit ) can't be compromised by session hijacking the sid that occurs with HTTP traffic.