3 ms·
You can carry the session ID in the URL. This also has the benefit of eliminating XSRF. The downside is that you have a horrendous URL if that type if thing bot
by hueving 12y ago
You can carry the session ID in the URL. This also has the benefit of eliminating XSRF. The downside is that you have a horrendous URL if that type if thing bothers you, and you can't have a "remember me" check box in your login.
- amatix 12y agoThis approach has some massive downsides - the session ID is sent via Referer to outbound links, URLs are logged all over the place (including browser histories), it's easy for people to publicly share it without thinking which then ends up in Google as well...
- al2o3cr 12y agoPartying like it's LITERALLY 1999...
- lutoma 12y agoThat's a horrible suggestion, it's not 1999 anymore…