QuestionQ40Verified/Cybersecurity Principles and RisksCopy linkReport a problemAsk AstroTutorSave questionExposing a session identifier in a URL is an example of which web-application-specific risk?AIdentification and authentication failuresBInsecure design and implementationCBroken access controlDCryptographic failuresShow AnswerAnswerExplanationA session identifier is an authentication credential. Including it in a URL can disclose it through logs, browser history, referrer headers, bookmarks, or shared links, potentially allowing session hijacking or fixation. OWASP identifies session IDs in URLs as an authentication/session-management failure.Learn moreOWASP A07:2021 – Identification and Authentication FailuresOWASP Session Management Cheat SheetShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion