I stumbled over this in the ASVS 3.0.1 (V3.6). I wonder what this is, I couldn't find any meaningful explanation.


This seems likely to refer to the practice simply writing session tokens into the URL as part of a GET request in the form of SomeAction.do;jsessionid=863F3D24DEFA?Id=19. This is obviously bad practice and not advised.

  • 1
    The full text of V3.6 reads Verify that the session id is never disclosed in URLs, error messages, or logs. This includes verifying that the application does not support URL rewriting of session cookies. Now that I think twice about it it seems plausible that your answer explains it pretty much. – countermode Sep 1 '16 at 12:27

It's not entirely clear what is meant without some kind of example, however I would speculate that this means, "Never store URL parameters in cookies." Doing so would potentially open a site up to lots of XSS vulnerabilities. If you're doing this with session variables, then a session could possibly be hijacked simply with a copied URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.