Re:HTTP/3 explained
by ams6110 on Tuesday February 05, 2019 @10:49AM
(#19086366)
Assuming https, the querystring is encrypted, so should be safe in transit. Could show up in server logs though, I'd think. The server can log a lot of things though, depending how it's configured.
[ Parent
| on HN ]
Session ID in URL is a terrible idea because guess what, people share links with each other. Example: A school enrollment system in Finland logs you on with another person's account if they give you the link to a page they are viewing (which they often do), because the session is in the query string.