4 ms·
why don't we do it anymore
by hackernewds 5y ago
why don't we do it anymore
- samwillis 5y agoIf you include the session ID in the url it can leak to other uses if they send a urls to someone, it also exposes the session id in intermediate proxy/router log files (if using plain http, not tls). So it’s basically a security risk. Before cookies had widespread support it was basically the only way to implement sessions.