Posted by Czapi on 02/22/07 16:04

Erwin Moller wrote:
> I say it is a myth that passing PHPSESSID by URL is less secure than passing
> it by cookie.
> Anybody who can eavesdrop on the traffic between the client and server can
> see the PHPSESSID, in a cookie, or in the URL.
> The content of the cookie is just plain there for anybody to read: in plain
> text.

Simple explanation, try to perform session fixation by sending an URL
over an email client or IM with trans_sid turned off.

--
Cz.

[Back to original message]