How a site recognises a visitor it has met before

Recognition works by handing out a token and asking for it back.

The general shape is a cloakroom ticket. On your first visit the site gives you a small marker and asks that you present it on later requests. Your browser keeps it and offers it automatically. The marker itself carries no meaning; it is not your name and should not be. It is a label the site can look up. On arrival the site reads the label, finds the corresponding record, and knows what it knew before. Take the ticket away and you become a stranger again, which is exactly what signing out does.

Because the marker is the whole basis of recognition, everything about the arrangement is defensive. It should be unguessable, so that possessing one tells you nothing about anyone else's. It should travel protected, because it is presented on every request. It should expire, because something that never expires accumulates risk indefinitely. And the site should be able to revoke one, so that a person can end a session they no longer want to be responsible for.

Notice what is not in the ticket: your permissions, your status, your account details. Those belong in the record the site holds, looked up fresh when needed. If they travelled with you, they would be claims from outside, and the first rule applies. The ticket is deliberately empty of meaning. That emptiness is not a limitation to be worked around. It is what makes the arrangement safe.