Session ID in URL Rewrite

[kumangxxx]

You want to:

• report a bug
• request a feature

Current behaviour

socket.io will add ?sid= to the url when trying to connect

Steps to reproduce (if the current behaviour is a bug)

Normal use of socket.io client for javascript

Expected behaviour

Can we move the sid to header ?

Other information (e.g. stacktraces, related issues, suggestions how to fix)

Context:
We ran penn test against our socket app using ZAProxy. One of the alert we got is this:

Session ID in URL Rewrite:
URL rewrite is used to track user session ID. The session ID may be disclosed via cross-site referer header. In addition, the session ID might be stored in browser history or server logs.

adding sid to url is problematic according to zaproxy.

my url is like this:

http://localhost:3000/socket.io/?channel=widget&EIO=3&transport=websocket&sid=0JfeAmWw8EceWQkTAAAA

can someone explain the security risk if someone can get other people's sid ?
can it be used to listen/publish or get older messages ?
can we move the sid to Header ?

thanks

[darrachequesne]

For future readers: please check my answer here.