Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?

share|improve this question
This thread posted by @Jim G. is worth reading for anyone interested: Basically: yes, some of the risk goes away. Because HTTP is an application layer protocol while SSL/TLS applies to TCP (a transport layer protocol) – rdasxy Mar 26 '12 at 7:50
up vote 1 down vote accepted

Yes, SSL mitigates the threat of a man-in-the middle attack.

The only shortcoming is that, with a long-running session, a hacker could potentially capture the session id in a server log and use it for malicious purposes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.