Re: Hijacking URL Encoded Session IDs using Referer Logs

Not to my knowledge. I guess the question would be why would you store the session id in a users url? I suppose people who are to lazy to learn about cookies and don't mind having the ID logged on the server side.  

Not to mention its *possible* that this id can be saved by a webspider and archived. If using cookies to store these id's you won't have to worry about this problem. (unless there is a new super spider which logs cookies that I am unaware of in production use?)

• zeno

>
> Is there anything on CERT about the fact that URL encoded session IDs
Received on Mon Nov 25 09:57:50 2002