Session ID URL Rewriting

Session ID URL rewriting happens when a user’s session ID is displayed in a website’s URL. Anyone accessing the URL through an unsecured Wi-Fi can continue with the session.

The attack commonly happens when session IDs are inserted into the URL instead of being stored in a cookie. Users might unintentionally share their session ID when they send links to other people. People with the links can then impersonate the original users. This type of attack is common in applications that use URL parameters to store session IDs.