There are three standard ways to pass data from the browser:
POST, and cookies (which are sent for both
POST requests). Here's an example request as it's sent to a server if you asked for www.example.org/spec.html?secret=foo:
GET /spec.html?secret=foo HTTP/1.1
Cookie: name=value; name2=value2
Putting session information in the URL makes it prone to being copied by the browser's user. From a visibility standpoint on the wire, though, it makes no difference. It's for this reason that sensitive data is often
POSTed. Whichever way you make a request, keep in mind it probably should be protected against CSRF.
As for cookies, they provide a way to store data that lasts across the duration of a session or throughout browser tabs.