4 ms·
Ask HN: Why do they make you login again?
If I visit service.com/fdoit?session=hashBase64 then I am connected to the service to f do it, but if I visit service.com I need to connect again (with a form on a 2nd page) and waste time. I know I should use bookmarks (for when the hashBase64 doesn't change) but why do we have this common behavior in 2025 ?
- theandrewbailey 1y agoIf anyone can access a session based on ID in a URL, that sounds like a security vulnerability waiting to happen. There are good reasons that we decided those things should go in cookies a long time ago.
- ttoinou 1y agoI guess it's stored in my cookies as well. But I need to visit that specific URL. Maybe I'm wrong and I only need to visit service.com/fdoit instead of service.com but then the same question remains
- anonymousd3vil 1y agoIts not best practice to store session details in URL, this can be compromised easily. Maybe try this, take the same URL with session id and launch it in incognito. If it still works, that means the service.com has a lot of security gaps to fill in. Otherwise, they might be storing it in cookies if its not accessible.
- ttoinou 1y agoI didn’t express myself correctly. I’m rather wondering why I can’t be automatically logged in the main service.com ? Let’s say the auth is based on serious security