Search code examples
urlsessioniduserid

Why id & sessionid in URL?


I see some URLs like this:

http://www.example.com/?view=profile&id=098&hash=589e8bed895198495d987d055699d2b9

Why some sites add ID and hashed password to URL? Is it the session ID? Is there any advantage with using URL like that for user profiles?


Solution

  • The intent is likely to prevent you from quickly stepping through pages with a predictable URL pattern.

    If their profile URLs were just like: http://www.siteadress.com/?view=profile&id=098

    you could go to http://www.siteadress.com/?view=profile&id=099, http://www.siteadress.com/?view=profile&id=100, etc. and expect to find content there. If the profiles include, say, e-mail addresses, it'd be a great find for a spambot to crawl through.