You can also mitigate it by including in the session token something from the server side that is sent by the client as part of the HTTP request but not as part

You can also mitigate it by including in the session token something from the server side that is sent by the client as part of the HTTP request but not as part of the query, such as a hash of their user-agent. I did something similar to this in the early 2000s, when setting a cookie lasting longer than 24h required approval from SECDEF: [0] This was a cookie-less FTP-over-HTTP browser, where you had to agree to the terms of service, and copying the link to someone else wouldn't mean they agreed to the terms of service. It was just a prototype. [0] https://rkeene.org/viewer/tmp/wwwftp_cgi.c.htm#line182 https://rkeene.org/viewer/tmp/wwwftp_cgi.c.htm#line182