3 ms·

> duplicate the session cookie in the URL Please don't do that. If you inadvertently paste the URL into an IM window, post in a forum, etc., it becomes trivial

• gnaritas 16y ago
  On the other hand, if you store it in the cookie you can't have multiple sessions running at once in different tabs. Session hijacking is only a concern if there's something worth stealing in the session, which isn't always the case. Both approaches have their advantages and disadvantages.