oldbloke's mutterings

That half-reminds me of a system at work I documented recently.

Basically, people get redirected through two layers of shit. First off, they get a form where they log in. When submitted, this sends back a HTTP redirect (302, I think) to /session123456/foo.html but also sets a cookie to 123456. When they request /session123456/foo.html but also send the cookie, they get HTTP redirected to /session/foo.html (and they rely on the cookie for the rest of the session); those without cookies carry on using the session ID in URL thingermy. Two redirects to hack about with cookies, but the user pretty much never sees anything going on.

Seems to work pretty well. A bit annoying to write as an infrastructure, but it seems to be easy to ignore once you're writing actual pages using it. Works pretty neatly.