PHP : Session ID in URL

The application enables PHP to include the session identifier into the URL. This can lead to session hijacking and session fixation.

Enabled option session.use_trans_sid allows to transmit the session identifier as part of the URL. An attacker can hijack the session or trick the user to use the prepared session that is under the control of the attacker.

The URL parameters are more visible than the parameters of a POST-request and cookie values as they can be stored in the browser history, bookmarks, log files, and other widely available repositories. If an attacker finds out the secret session identifier, he/she will be able to hijack the user’s session.

Besides that, the disclosure of the session ID in the URL leads to an attack such as “session fixation”. Sample attack: an attacker creates a new session, stores its ID and tricks the victim into passing authentication with this session identifier.