The session identifier is part of a URL, for example as ;jsessionid=... or ?PHPSESSID=.... URLs are stored and shared in many places that are not designed to protect credentials: browser history, server and proxy access logs, bookmarks, analytics tools and the Referer header sent to other sites. Anyone who can read one of these copies can use the session until it expires. A URL that carries a session identifier is also the classic vehicle of session fixation attacks.

1. Disable URL based session tracking in the application server and the framework, for example <tracking-mode>COOKIE</tracking-mode> in web.xml or session.use_only_cookies=1 in PHP.

2. Carry the session only in a Secure, HttpOnly cookie.

3. Issue a new identifier on login so that an identifier planted before authentication is useless afterwards.

• CWE-598: Use of GET Request Method With Sensitive Query Strings
• OWASP Session Management Cheat Sheet