From: boutell	Date: August 24th, 2006 06:51 pm (UTC)		(Link)

Oh, I absolutely agree with you about the awfulness of sessions implemented via URLs. You can make the system tolerant of expired session IDs in URLs, but it's still crappy for pages that are meant to be accessible both when logged in and not logged in. People link to them and search engines don't know how to combine the links into a reasonable estimate of the page's popularity.

But the results of this informal poll show that a disproportionately technical and privacy-minded group of people have accepted session cookies as harmless, or at least necessary. Which means I can recommend site designs that require them for logged-in features, unless you're stuck with an arbitrary no-cookies decree from on high.

Another semi-acceptable approach is to keep session ID information in forms and make every single link on the site a POST-method form submission. That can work and have reasonable, indexable links if it's done very carefully. But it leads to weird site designs, with buttons used where normal links would be perfectly appropriate. It's very 1995.