SecurityInnovation/TMContentReview — Issue #35: Check for What the Developer Does When Cookies are Disabled
Author: SergeTruth
Created: 2011-11-07 22:17:36+00:00
State: open

There are other problems with putting SessionIDs into URLs. URLs are cached by the browser, intermediate server proxies and written to web server logs. Putting session ids into the URL could expose session ids to attackers.

Also there is no mention of the need to set the HTTP_ONLY and secure flags on session cookies.

Most web sites require cookies.