Session IDs can also be transmitted via GET requests

• A. POST requests
• B. WebSocket frames
• C. PUT requests
• D. GET requests

Answer: (D)

Session IDs can be transmitted through the URL because a GET request sends data in the query string of the URL. If a session identifier is appended as a parameter (for example, ?sessionid=abc123), it becomes part of the address the user sees and shares. This makes the session ID vulnerable to exposure via browser history, logs, and Referer headers when navigating to other sites. That’s why this method is generally discouraged in favor of keeping session state in secure cookies or using authorization headers. While GET exposes session IDs in the URL, other methods like POST or PUT send data in the request body, and WebSocket frames carry data differently, so the specific exposure described here points to the URL in GET requests.