Hacker News Reader

> duplicate the session cookie in the URL

Please don't do that. If you inadvertently paste the URL into an IM window, post in a forum, etc., it becomes trivial for me to steal your session.

View on HN

On the other hand, if you store it in the cookie you can't have multiple sessions running at once in different tabs. Session hijacking is only a concern if there's something worth stealing in the session, which isn't always the case. Both approaches have their advantages and disadvantages.

Reply on news.ycombinator.com