security - Harm of passing session id as url parameter -

so noticed 1 of internet banks websites passing session id url parameter. ( see image below )

i didn't see anywhere ';' in url, in case after 'private;'.

1) use of ';'?

2) , why internet bank, needs securest place in internet passing session id url parameter?

at first, thought doing because of users disallow use of cookies, again, if allow it, use cookies, if not - url, allow use of cookies, thats not case.

3) guess should have other security measures? be?

4) , 1 can possibly if knows others valid session id? know, can quite log others peoples session if know id, because not hard edit cookies , easier pass session id url parameter, if have like:

session_id($_get[sessionid]);

thanks!

1) should ask whoever designed application red box covering. url can want; convention of key=value&key2=value2 - convention. in case, it's java, , commonly uses convention of ;jsessionid=.... sid.

2) it's not that big of deal. normal users can't copy-paste cookies can copy-paste parameter, power users can whatever want (using mechanize, wget, curl , other non-browser means, or browser extensions). , if allow users , disallow some, it's not of security precaution, it? basically, cookie sid make attack bit harder, it's putting front door key under mat - doesn't keep door secure. additionally, cookies shared between tabs: if site wants logged in 2 accounts @ once, can't cookies.

3) serverside security, yes. 1 effective countermeasure one-time sids (each time visit page, server reads session current sid, starts new session new sid next request). less effective still method validate other information consistency (e.g. - still same ip? still same browser?)

4) yes, if know someone's valid sid, , server not adequately protect against session fixation, can "become" person. might enable attacker to, say, pay bills money, instance.