A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.

  • 1
    If a tester has marked this as a vulnerability, they need to explain what it leaves you vulnerable to. – MechMK1 Sep 11 at 11:36
  • What sort of authentication scheme are you using? Is it a traditional random session id? Is there a reason for putting it in the body? – Anders Sep 11 at 13:02
  • 2
    One issue is that you can't mark it as HTTP-only if it's in the body. – Anders Sep 11 at 13:03
  • You mean in response? – postoronnim Sep 12 at 13:57
  • Revealing sessionID in any request using GET query string or POST body is treated as vulnerability (rather minor severity). But how serious is this (severity), it depends on other checks of the app. And I agree with Andres - using session cookies without "httponly" flag is like asking for trouble. – Bartosz Rosa Sep 16 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.