Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?

  • This thread posted by @Jim G. is worth reading for anyone interested: answers.google.com/answers/threadview/id/758002.html Basically: yes, some of the risk goes away. Because HTTP is an application layer protocol while SSL/TLS applies to TCP (a transport layer protocol) – rdasxy Mar 26 '12 at 7:50

Yes, SSL mitigates the threat of a man-in-the middle attack.

The only shortcoming is that, with a long-running session, a hacker could potentially capture the session id in a server log and use it for malicious purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.