3-1—Session ID in URL Rewrite

PUBLISHEDsecurity alertMedium

Passive

Metadata

Alert ID:: 3-1
Risk:: Medium
Type:: Passive
CWE:: CWE-200Exposure of Sensitive Information to an Unauthorized Actor

摘要

URL rewrite is used to track user session ID. The session ID may be disclosed via cross-site referer header. In addition, the session ID might be stored in browser history or server logs.

解决方案

For secure content, put session ID in a cookie. To be even more secure consider using a combination of cookie and URL rewrite.

参考

browse all alerts