Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:
Here's how it works:
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Yes, SSL mitigates the threat of a man-in-the middle attack.
The only shortcoming is that, with a long-running session, a hacker could potentially capture the session id in a server log and use it for malicious purposes.