Ask HN: Why do they make you login again?

2 pointsttoinou4 comments

If I visit service.com/fdoit?session=hashBase64 then I am connected to the service to f do it, but if I visit service.com I need to connect again (with a form on a 2nd page) and waste time. I know I should use bookmarks (for when the hashBase64 doesn't change) but why do we have this common behavior in 2025 ?

View on HN

Its not best practice to store session details in URL, this can be compromised easily. Maybe try this, take the same URL with session id and launch it in incognito. If it still works, that means the service.com has a lot of security gaps to fill in. Otherwise, they might be storing it in cookies if its not accessible.

I didn’t express myself correctly. I’m rather wondering why I can’t be automatically logged in the main service.com ? Let’s say the auth is based on serious security

If anyone can access a session based on ID in a URL, that sounds like a security vulnerability waiting to happen. There are good reasons that we decided those things should go in cookies a long time ago.

I guess it's stored in my cookies as well. But I need to visit that specific URL.

Maybe I'm wrong and I only need to visit service.com/fdoit instead of service.com but then the same question remains

Reply on news.ycombinator.com