Why does Drupal have both "sid" and "ssid" field in the session? Learning more about Drupal core so I can be a better contributor, understand security better, etc.

I noticed that on creating a session Drupal uses both an "sid" and "ssid" field. The code seems to indicate they are both the same (the little code I've been able to decipher so far), 'sid' &amp;&amp; 'ssid' = session_id(), and looking at the DB only the sid is set in my own session. 

Why do both columns exist? Is it a security measure? If so what does it do? Is it a legacy field from an old system?

Looking at Drupal 7 code.
Yes it is a security measure; sid is the session id for HTTP traffic &amp;  ssid is the session id for HTTPS traffic. The idea here is that secure parts of your website (e.g. https://www.example.com/user/*/edit ) can't be compromised by session hijacking the sid that occurs with HTTP traffic.