Is storing a session id in a cookie a better practice than a get var?

Question

The title pretty much says it all. A cookie seems to have a few advantages to me; however, I'll wait to see what others say.

Also - assuming a cookie is better, what can be done to make passing the session by GET variable better?

Specifically I'm thinking about PHP; however, this should apply generally.

Answer 1

Storing it in a cookie as opposed to in a GET var has at least one advantage, in that the session ID'd URL will never be bookmarked by any user.

Answer 2

Cookies are the better way to go.

The downsides of having the session ID in the GET variable are

• URLs look more ugly

• it screws up links and bookmarking (although this is more a cosmetic problem, as an expired session will simply be deleted and a new one created)

• it can be slightly less secure (when people share links containing the session ID, and inadvertently have their session "hijacked").

Search engines, however, will remove the session ID from indexed URLs, as long as they are named after a standard scheme (PHPSESSID, SID...) so this is not a problem.

The usual way to go here (and I think, PHP's default behaviour) is to use Cookies when possible, and to fall back to GET variables if they are disabled.

As to how to make GET variables "better" - one way to make URLs containing them a bit more pretty is to use URL rewriting, so you can have e.g.

example.com/category/page/1234567890 

123456890 being the session ID.

However, note that this will lead to search engines being unable to strip out the session ID, because they have no way of telling it is one.

The security issue that a session ID could inadvertently be copy+pasted to a new user can be controlled through low session timeouts, and anti-"session hijacking" measures as shown e.g. in this question. However, the accepted answer suggests using session.use_only_cookies .....

Answer 3

Storing it in a cookie prevents it from being accidentally bookmarked or given to someone in a link.

Having said that, PHP manages its session cookies on its own, so it's not something you need to manually do. PHP 5.3.0 and later releases use only cookies by default (session.use_only_cookies 1). Prior to this, it would try cookies first by default and fall back to get variables if that failed (session.use_cookies 1).

Edit: Although PHP manages its own session cookies, you can modify the session cookie's parameters before calling session_start().

Answer 4

I can think of more reasons to use a cookie

Pros for not using cookie

1. Cookie can be disabled and site will still work

Pros to using a cookie

1. More secure
2. Search engines don't index it
3. People can't copy and paste it to friends
4. People can't book mark it
5. You can easily expire it using cookie expire time

Answer 5

Despite using cookies seems more secure and convenient, you can, and probably should, enhance native session mechanism.

PHP provides a convenient way, but if you are aiming for more security than convenience, you would like to change some stuff on session hadling.

Read Chris Shiflett articles about PHP sessions to get a better understanding.