Re: Hijacking URL Encoded Session IDs using Referer Logs

[zeno <bugtraq () cgisecurity net>]

Not to my knowledge. I guess the question would be why would you store the session id in a users url? I suppose
people who are to lazy to learn about cookies and don't mind having the ID logged on the server side.
 

Not to mention its *possible* that this id can be saved by a webspider and archived. If using cookies to store
these id's you won't have to worry about this problem. (unless there is a new super spider which logs cookies
that I am unaware of in production use?)

- zeno



> Is there anything on CERT about the fact that URL encoded session IDs 
> get passed to referenced sites in the HTTP referer header?
>
> Thanks,
> Bob