cookieless attribute to AutoDetect, the application will store the session token in a
cookie for users who accept them and in the URL for those who won’t. This means that
only the users who use cookieless tokens will still be vulnerable to session hijacking.
That's often acceptable, given the alternative—that users who deny cookies wouldn't be
able to use the application at all. It is ironic that many users disable cookies because of
privacy concerns when doing so can actually make them more prone to attack.




