From my understanding, the attack guesses the key used by the server. And in most cases the same key is used for almost everything. So they can guess it with so

From my understanding, the attack guesses the key used by the server. And in most cases the same key is used for almost everything. So they can guess it with something trivial and then use it to make a fake cookie or encrypted form element to get access. SSL and session ids have nothing to do with the padding oracle attack itself.