The fix, in one snippet
Set-Cookie: __Host-session=…; Secure; HttpOnly; SameSite=Lax; Path=/Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now checks discovered query-string names for established session and access-token names. Values are never stored in evidence.
Why it matters
URLs are copied into browser history, server and proxy logs, analytics systems and Referer headers.
How to fix it
Carry sessions in Secure, HttpOnly, SameSite cookies and exchange one-time login codes immediately before redirecting to a clean URL.
Where this fits
Session token exposed in URL is check 1 of 5 that the session token url scanner runs under cookie security, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
What fixing this still leaves open
Session token exposed in URL closes one route in. Immediately below it: Cookie without HttpOnly flag, where a cookie is readable by JavaScript because it lacks the HttpOnly attribute; Cookie without Secure flag, where a cookie is set without the Secure attribute, so the browser will also send it over plain HTTP; Cookie without SameSite attribute, where a cookie is set without a SameSite attribute, or with SameSite=None but no Secure flag.
Found in the same scan
The session token url scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature, and SQL injection, where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator. A single run of session token url scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Session token exposed in URL (high severity)
Scanner check id: session-token-in-urlThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
