Session hijacking -> Session Id In Url

Session hijacking -> Session Id In Url

If you place a session token directly in the URL, it increases the risk of an attacker capturing and exploiting it. Anyone who follows that URL inherits the session. Therefore, session id should never be exposed in url.

As you can see, session id of a user was exposed in url.

References

• https://www.acunetix.com/blog/web-security-zone/session-token-in-url-vulnerability/