This question already has an answer here:

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users?


Also what measures can be taken to make this kind of URLs more secure.

marked as duplicate by Xander, schroeder, AJ Henderson, TildalWave, Mark Oct 16 '14 at 19:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    To a large degree, it depends on your threat model. See the other question to review the potential issues with secret URLs. – Xander Oct 16 '14 at 14:29
  • Also see other questions and their answers on the topic – TildalWave Oct 16 '14 at 18:05

A session id should be a Cookie parameter, and should never appear in the URL. Any value in the URL A will show up in the referer header, as well as access log files. A web application will end up transmitting authentication credentials to other websites, and storing them in plaintext on the filesystem.

Additionally, when you pass a session id in the URL, you open the door for Session Fixation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.