News for hackers. Stuff that matters.
Re:HTTP/3 explained by duiker101 on Tuesday February 05, 2019 @10:08AM (#19085895)
Haven't seen it in a long time but websites used to keep the session id in the query string
Re:HTTP/3 explained by krferriter on Tuesday February 05, 2019 @11:46AM (#19086984)
That's a bad idea because it is visible on the UI and anywhere the user copies/saves the URL, and it would also still have all the downsides that cookie-based tracking enables. Cookies are how HTTP application sessions work, it isn't possible to just get rid of them, without replacing them with something identical in functionality even if you change the name.
Re:HTTP/3 explained by snazz on Tuesday February 05, 2019 @10:36AM (#19086194)
Wouldn’t that make the session key show up in log files on the server and on any network infrastructure between the server and the client?
Re:HTTP/3 explained by ams6110 on Tuesday February 05, 2019 @10:49AM (#19086366)
Assuming https, the querystring is encrypted, so should be safe in transit. Could show up in server logs though, I'd think. The server can log a lot of things though, depending how it's configured.
Re:HTTP/3 explained by Ndymium on Tuesday February 05, 2019 @10:57AM (#19086471)
Session ID in URL is a terrible idea because guess what, people share links with each other. Example: A school enrollment system in Finland logs you on with another person's account if they give you the link to a page they are viewing (which they often do), because the session is in the query string.