Clarification on passing the session id.

[manngo]

The page at https://www.php.net/manual/en/session.idpassing.php includes the following:

There are two methods to propagate a session id:

• Cookies
• URL parameter

The page at https://www.php.net/manual/en/function.session-start.php includes the following:

session_start() creates a session or resumes the current one based on a session identifier passed via a GET or POST request, or passed via a cookie.

That would imply the using POST is a third method to propagate the session id, and would certainly be more secure than using a URL parameter. It would also imply a conflict between the two pages.

I haven’t finished testing this, but is it possible to get clarification on whether POST request is a valid third method? I can’t find any other discussion of this anywhere, and this would certainly have implications to using sessions with CURL and AJAX.

If my interpretation is correct, I would propose correcting one or the other page.

[cmb69]

Indeed, the description of session_start() is a bit misleading; instead of "GET or POST" it should also talk about "URL parameter".

Anyway, wrong repo, so I'm going to transfer.

[manngo]

Apropos all of this, I’m getting indifferent results with both the POST and GET methods.

Using cookies, of course, works well, but putting PHPSESSID in either the POST data or the URL doesn’t automatically fetch the correct session unless I also set the id using session_id().

That’s not the impression given by the above pages.