A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.

  • 2
    If a tester has marked this as a vulnerability, they need to explain what it leaves you vulnerable to.
    – user163495
    Sep 11, 2019 at 11:36
  • What sort of authentication scheme are you using? Is it a traditional random session id? Is there a reason for putting it in the body?
    – Anders
    Sep 11, 2019 at 13:02
  • 3
    One issue is that you can't mark it as HTTP-only if it's in the body.
    – Anders
    Sep 11, 2019 at 13:03
  • You mean in response? Sep 12, 2019 at 13:57
  • 1
    Revealing sessionID in any request using GET query string or POST body is treated as vulnerability (rather minor severity). But how serious is this (severity), it depends on other checks of the app. And I agree with Andres - using session cookies without "httponly" flag is like asking for trouble. Sep 16, 2019 at 21:51


You must log in to answer this question.

Browse other questions tagged .