How do Pressflow Drupal sites handle user Cookies? Is this something handled by Drupal? What PHP, Apache, Varnish settings affect cookies?

Additionally, what's the difference in cookie handling between plain-vanilla Drupal and Pressflow?

I was seeing that in drupal_session_commit() boostrap.inc calls session_destroy():


  session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. To use the session variables again, session_start() has to be called.
  
  In order to kill the session altogether, like to log the user out, the session ID must also be unset. If a cookie is used to propagate the session ID (default behavior), then the session cookie must be deleted. setcookie() may be used for that.


Apparently in Pressflow drupal_session_commit() gets called on every page like this:

// Perform end-of-request tasks on every page.
drupal_page_footer(), common.inc
    // Write the session, and open one if needed.
    drupal_session_commit(), bootstrap.inc
        // If our user is anonymous, Pressflow "Destroys empty anonymous sessions"
        // Destroy all data registered to a session
        session_destroy(); 
            // Called by PHP session handling with the PHP session ID to end a user's session.
            sess_destroy_sid($sid), session.inc


What implications, if any, does this have for user tracking in software like Omniture and Google Analytics?

See related post to cookies here: https://stackoverflow.com/questions/871283/how-do-tracking-cookies-work

Link to Pressflow documentation.
Cookies/sessions are handled by both Drupal and PHP. Drupal register some functions that PHP will call, when certain things need to happen, like destroying a users session. PHP handles most of the basic stuff and Drupal override some of it, store users sessions in the database.

I'm not familiar with Omniture but if it's anything like GA, a users session/cookie wont effect tracking at all. Cookies are used to identify the user, so they don't have to type in their username/password at every page. Without cookies, Drupal wouldn't be able to tell the users apart and would need some other form of identification, like a login for every new page load.

This is why, some people try to steal cookies, as that is the same as having the user log in and leave the computer, given the thief full access.