I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is it correct to use form field(hidden) for storing Session Token and Why is passing the session id as url parameter insecure?
With that in mind, is there a secure way to handle sessions if cookies are disabled?
As an example, I noticed my company's shopping cart puts session ID's in a hidden form field (for the add to cart action), and if cookies are disabled they're also appended to query strings for all links. I checked a cached google page and sure enough google had cached its own session ID. I then grabbed that session ID and visited google's shopping cart - it was expired by this time. Still, I'm obviously not a fan of this being possible in the first place.
On a related note, when I pasted the first link above, it originally included ?newreg=XXXXXXX (looked like a session ID of some sort). I had just registered for security.stackexchange.com and was brought back to that URL. Maybe it's not a problem but I thought it was a nice coincidental example of how session ID's can accidentally be shared.