Is session id in url itself for all the requests an issue?


I wouldnt call it a security flaw but it's definitely not a good practice to have Session token in URL .

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

  • It's also a good practice to provide sources for citations. ;) – Esa Jokinen May 5 '19 at 9:55
  • 1
    Sorry about that.Thanks for the edit – Vipul Nair May 5 '19 at 10:36
  • 1
    Np. +1 for the answer, anyway. :) – Esa Jokinen May 5 '19 at 10:38
  • Just realized there is a benefit also in doing this, if prevents from csrf token in a very different way. Usually in csrf, an attacker set value of action attribute as the url where request would be sent but an attacker can't set session id in that url this can prevent from csrf. – Rootrj May 11 '19 at 12:28
  • Wow.Introducing a flaw to solve a different flaw.Good job – Vipul Nair May 11 '19 at 13:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.