Study. uk . com
  1. Home
  2. All questions
  3. Question 289

CompTIA Security+ study material · question 289 of 611

Why should a session identifier never be carried in the URL?

  1. It leaks through browser history, proxy logs and the Referer header
  2. URLs cannot be transmitted over TLS
  3. URLs have a length limit
  4. Search engines cannot index such pages
Show the answer

Answer: A. It leaks through browser history, proxy logs and the Referer header

A cookie is not written into any of those places, which is why the identifier belongs there instead.

Source: OWASP Session Management Cheat Sheet (OWASP) — OWASP Session Management Cheat Sheet › Session ID Exchange Mechanisms

Challenge yourself on this topic → Study as cards