You discover that a web application stores session IDs in URLs. What immediate action should you recommend?

Question

Options

• AStore session IDs in secure cookies instead
• BIncrease the length of session IDs
• CDisable multi-factor authentication
• DImplement directory traversal protection

• A
  72% (31)
• B
  5% (2)
• C
  16% (7)
• D
  7% (3)

Explanation

Storing session IDs in URLs exposes them in browser history, server logs, referrer headers, and shared links - anyone who sees the URL can hijack the session. Option A is correct because secure, HttpOnly cookies are designed specifically for session management: they're not logged in the same way, aren't accessible to JavaScript (reducing XSS risk), and aren't leaked via the referrer header.

B is wrong because longer session IDs only improve entropy against brute-force guessing - they do nothing about the exposure problem of IDs being visible in URLs. C is wrong because disabling MFA makes authentication weaker, not stronger, and has no bearing on session ID storage. D is wrong because directory traversal is a separate vulnerability class (attackers accessing files outside the web root) and is unrelated to session management.

Memory tip: Think "sessions belong in secrets" - cookies can be flagged HttpOnly and Secure, keeping them out of logs and scripts, whereas anything in a URL is public by design.

No community discussion yet for this question.