Pasting the required url to address bar destroys the session..pls help

Question

I get a mail in which i am given a link to a page of accounthistory page like this:

http://www.mydomain.com/accounthistory.php?order_id=491

using this i can view the order detail, but when I am logged in to my account and I access the same link copying from mail i got, I get the page but i get logged out.

this page is also available in general of my site after login and the url is displayed as

http://www.mydomain.com/accounthistory.php?order_id=491&osCsid=v2i9agpobsce2dvlfgi28449j3

hence my question is

If I am logged in my account and using the link which i got in my mail i.e. http://www.mydomain.com/accounthistory.php?order_id=491

what should i do so that i do not get logged out of my account?

after looking through the both ways, i found that i need the "osCsid" appended to my url which i got in my mail. and from debugging i found it to be saved in session.. how can I use it to get my point work?

Answer 1

If your shop system doesn't use Cookies for sessions, carrying the session ID in the URL is in fact the only way to continue the session.

However putting the session ID into the E-Mail is not very elegant. The session ID will become invalid at some point, and it makes the URL long and ugly.

I would consider activating Cookie based authentication for those clients that accept it.