Server-side correlation is the practice of matching browser-side signals, such as cookies, request headers, IP addresses, or timing patterns, with backend records to connect actions that occur across different requests or contexts. The browser may only see a small token, but the server can combine that token with logs, account data, and event streams to reconstruct a fuller picture of user activity.
This matters in cyber security because correlation can support legitimate goals like fraud detection, session management, and ad attribution, but it can also increase privacy risk and tracking reach. In attacks, adversaries and platforms may use it to link seemingly separate visits, evade simple client-side protections, or confirm that a token belongs to the same device or user. In defenses, analysts use the same technique to spot suspicious reuse of identifiers, impossible travel, bot behavior, or coordinated abuse across endpoints and services.