A session ID is a single piece of token that is used to distinguish a user on a specific website. A session token is allocated when a user browses a website or logs into a website. It is assigned by the web server to a user, which is then used to keep a track of the activities or for allowing certain privileges on the web application.
On the client side, a session token is saved as an HTTP cookie and may be transmitted via GET/POST or via set-cookie header to the server upon every request the client makes to the server.
A session ID by no means is an authorization credential; but, it could be used in place for authorizing a user without needing the password. Since a session token is accepted to identify the user to the server, an attacker who was able to get your token somehow can simply impersonate you.
There are various methods to compromise a session token such as steal unencrypted tokens through man in the middle attack, guessing weak session ID and Session Fixation.
A session token/ID is very critical to the user because if an attacker takes hold of it, he would be able to take control over the session. Therefore, it’s extremely important to make sure that the session ID is random and cannot be guessed by brute force attacks.