[WB] - Dynamic webdev site and session Hijacking (6 replies)

After one scan of one webdev application we encounter the following problem:
If we copy the URL of one dynamic page send it by emails to another PC and use it the other user can see the data.

Anyone manage to solve this issue in the dynamic webdev sites?

Result of the scan:
Sensitive information within URLs may be logged in various locations, including the user's browser,
the web server, and any forward or reverse proxy or caching servers between the two endpoints.
URLs may also be displayed on-screen, bookmarked or emailed between users. This can also allow for
the disclosure of the session token to a third party via the Referrer header when any off-site links are
followed.
Placing session tokens into the URL increases the risk that they will be captured by an attacker. A
compromise would allow an attacker unauthenticated access to a valid user's session, placing the
application user's personal information at risk as well as increasing the likelihood of loss of integrity
and confidentiality within the application.
Session tokens hardcoded into the HTML for access to other locations can enable an attacker to
impersonate the application regardless of the user and gain access to application functionality or
information that usually requires a license.