Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Using URL rewriting for session management for plain HTTP communication is a recipe for disaster, however, does some of that risk go away if you're using SSL (https)?

share|improve this question
    
This thread posted by @Jim G. is worth reading for anyone interested: answers.google.com/answers/threadview/id/758002.html Basically: yes, some of the risk goes away. Because HTTP is an application layer protocol while SSL/TLS applies to TCP (a transport layer protocol) –  rdasxy Mar 26 '12 at 7:50

1 Answer 1

up vote 1 down vote accepted

Yes, SSL mitigates the threat of a man-in-the middle attack.

The only shortcoming is that, with a long-running session, a hacker could potentially capture the session id in a server log and use it for malicious purposes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.