# Url based sessions **URL:** \ **Category:** Rails\ **Created:** [October 29, 2007, 5:06pm UTC](https://www.ruby-forum.com/t/url-based-sessions/118630 "2007-10-29T17:06:36Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![martijndenerd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b19c9b/32.png) [@martijndenerd](https://www.ruby-forum.com/u/martijndenerd)\ **Post date:** [October 29, 2007, 5:06pm UTC](https://www.ruby-forum.com/t/url-based-sessions/118630/1 "2007-10-29T17:06:36Z")
Hi, I trying to make the sessions in my rails app independent of the availability of cookies at the client side. In order to achieve this i am using a plugin \*, that adds \_session\_id to the querystring by adding it to all rendered urls, and adding a hidden input field with the session\_id to all forms. This url and form rewriting is working great, also for the ajax links generated by link\_to\_remote. A bit tricky is to get rails to recognize this param as the session\_id, according to a recent rails security update mail \*\*, i have to set cookie\_only to false. The description in the mail doesn’t work, but setting session\_options[:cookie\_only]=false in application.rb does the job though. And for the non-ajax version of my site, the session is working as hoped. The problem is when i try the same thing with javascript enabled, using ajax requests, then rails doesn’t recognise my \_session\_id param in the as the session\_id. I can see the param is there, but rails just ignores it and assigns a new session\_id. If anyone would has an idea what difference between a html request and an ajax request causes this problem, then that would be great. Thanks, Martijn - [http://wiki.rubyonrails.org/rails/pages/Hidden+Field+Session](http://wiki.rubyonrails.org/rails/pages/Hidden+Field+Session)\*\* \*\* [http://groups.google.com/group/rubyonrails-security/browse\_thread/thread/239b034f4f808834?hl=en](http://groups.google.com/group/rubyonrails-security/browse_thread/thread/239b034f4f808834?hl=en)