PHP session tokens are normally transmitted through HTTP cookies. However, for clients that do not support cookies and when the PHP `session.use_trans_sid` setting is enabled, those tokens can be transmitted as URL parameters.

## Why is this an issue?

GET URL parameter can be disclosed in a variety of ways:

- Directly in a web browser address bar.
- In navigation history.
- In web servers or intermediate proxies log files.

### What is the potential impact?

Attackers with access to any of those disclosure locations will be able to see and steal a victim’s session token. They can then use it to log in as the user, impersonate their account, and take advantage of their privileges.

Such an attack can be more or less severe depending on the victim’s privileges. Common security impacts range from data theft to application takeover.

#### Data theft

Attackers with access to a compromised account will be able to disclose any information stored on it. This includes the Personally Identifiable Information (PII) of the user.

The confidentiality of PII is a requirement from national security regulatory authorities in most countries. Insufficiently protecting this data could have legal consequences and lead to fines or other prosecutions.

#### Application takeover

Attackers compromise the account of a high-privileged user could modify internal web application logic, disrupt workflows, or change other application’s settings in a way that will give them full control over it.

Such an attack would lead to reputational damages and financial and legal consequences.

## How to fix it

### Code examples

#### Noncompliant code example

    ; php.ini
    session.use_trans_sid=1  ; Noncompliant

#### Compliant solution

    ; php.ini
    session.use_trans_sid=0

### How does this work?

The compliant code example disables the `session.use_trans_sid` setting.

Note that this parameter is off by default.

## Resources

### Standards

- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP - Top 10 2017 Category A6 - Security Misconfiguration