Session token in URL
Summary: PortSwigger Research describes the risk of placing session tokens in URLs, noting that sensitive information in URLs may be logged in the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also appear on-screen, be bookmarked or emailed by users, and be disclosed to third parties through the Referer header when off-site links are followed.
What's compelling: A session token in a URL can leak through logs, browser history, and the Referer header sent to third parties, so an attacker who captures it inherits the session; PortSwigger recommends HTTP cookies or hidden POST fields instead.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026