2

This question already has an answer here:

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users?

https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Also what measures can be taken to make this kind of URLs more secure.

marked as duplicate by Xander, schroeder, AJ Henderson, TildalWave, Mark Oct 16 '14 at 19:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    To a large degree, it depends on your threat model. See the other question to review the potential issues with secret URLs. – Xander Oct 16 '14 at 14:29
  • Also see other questions and their answers on the topic – TildalWave Oct 16 '14 at 18:05
5

A session id should be a Cookie parameter, and should never appear in the URL. Any value in the URL A will show up in the referer header, as well as access log files. A web application will end up transmitting authentication credentials to other websites, and storing them in plaintext on the filesystem.

Additionally, when you pass a session id in the URL, you open the door for Session Fixation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.