3 ms·
Haven't seen it in a long time but websites used to keep the session id in the query string
by duiker101 8y ago
Haven't seen it in a long time but websites used to keep the session id in the query string
- snazz 8y agoWouldn’t that make the session key show up in log files on the server and on any network infrastructure between the server and the client?
- ams6110 8y agoAssuming https, the querystring is encrypted, so should be safe in transit. Could show up in server logs though, I'd think. The server can log a lot of things though, depending how it's configured.
- Ndymium 8y agoSession ID in URL is a terrible idea because guess what, people share links with each other. Example: A school enrollment system in Finland logs you on with another person's account if they give you the link to a page they are viewing (which they often do), because the session is in the query string.
- krferriter 8y agoThat's a bad idea because it is visible on the UI and anywhere the user copies/saves the URL, and it would also still have all the downsides that cookie-based tracking enables. Cookies are how HTTP application sessions work, it isn't possible to just get rid of them, without replacing them with something identical in functionality even if you change the name.