Pasting the required url to address bar destroys the session

Question

I get a mail in which I am given a link to a page of account history page like this:

http://www.mydomain.com/accounthistory.php?order_id=491

Using this I can view the order detail, but when I am logged in to my account and I access the same link copying from mail I got, I get the page, but I get logged out.

This page is also available in general of my site after login and the URL is displayed as

http://www.mydomain.com/accounthistory.php?order_id=491&osCsid=v2i9agpobsce2dvlfgi28449j3

Hence, my question is:

If I am logged in my account and using the link which I got in my mail, i.e.

http://www.mydomain.com/accounthistory.php?order_id=491

what should I do so that I do not get logged out of my account?

After looking through the both ways, I found that I need the "osCsid" appended to my URL which I got in my mail. And by debugging I found it to be saved in session. How can I use it to get my point work?

score 3 · Accepted Answer · answered Sep 10 '10 at 05:33

3

If your shop system doesn't use Cookies for sessions, carrying the session ID in the URL is in fact the only way to continue the session.

However putting the session ID into the E-Mail is not very elegant. The session ID will become invalid at some point, and it makes the URL long and ugly.

I would consider activating Cookie based authentication for those clients that accept it.

answered Sep 10 '10 at 05:33

Pekka

442,112
142
972
1,088

-ve Potter, :-(, any other alternative!! – OM The Eternity Sep 10 '10 at 05:34
@OM alternative to what? Why are you not using Cookies? – Pekka Sep 10 '10 at 05:36
Regarding last line, Or is there any way to check for the existing session id and appending in requested url which I paste in address bar? – OM The Eternity Sep 10 '10 at 05:37
@OM nope, it's either session ID or Cookies. Why can't you use cookies? – Pekka Sep 10 '10 at 05:37
@OM re your update, yes there is, it's called Cookies ;) I know no other way. – Pekka Sep 10 '10 at 05:39
is there any way to check for the existing session id and appending in requested url which I paste in address bar? – OM The Eternity Sep 10 '10 at 05:44
1

@OM only if your session is cookie based. There is no other way. We can do this all day :P – Pekka Sep 10 '10 at 05:50
@Peter true, but in that case, it is probably not advisable to carry on the session by passing on the session ID. – Pekka Sep 10 '10 at 06:08
@Pekka - Thanks... I realized the issue was continuing an ongoing session and deleted that comment :/ – Peter Ajtai Sep 10 '10 at 06:08

Pasting the required url to address bar destroys the session

1 Answers1