Turn off session hash

[NeverBored]

Is it possible to turn off the session hash in urls? Ideally of course in a plugin...

[Marco van Herwaarden]

Why would you want to do this? Session hash is only added if cookies can not be used.

[NeverBored]

Yes I know what it does and the ramifications. I'm mainly interested in doing this for guests only and even only a vb integrated section of my site (that I want to keep integrated and sessioned for members). I was hoping there was some way to simply kill the hash in a plugin, and I could tweak it from there to meet my needs.

[NeverBored]

Bump

[Marco van Herwaarden]

I still don't understand what your goal is by removing the hashes. It will break functionality if you would do that.

[NeverBored]

What's not to understand? I don't want the session hash in the url, that is my goal. Like I said, I know the functionality it will "break", it is of no concern. I don't think I can explain what I want to do any clearer. I didn't ask what it will do to remove the hash, I even said I know exactly what it would do, I just want to know how to remove it.

[ChopSuey]

You mean session ID in the URL ? I had a post about killing session ID's in the URL on my webmaster forum but its currently down right now. Try using Google.

When i tried to kill session ID's i always got an internal server error.

[NeverBored]

You mean session ID in the URL ?

Yup, that's what I want to do.

[Speysider]

You seem to be ignoring the fact that you will not be able to use your forum if you do this

[ChopSuey]

Yup, that's what I want to do.

On one of my forums, there is a post about killing session ID's .....i'll find it and post it later.

[NeverBored]

That would be great... I've searched around and can find various places talking about doing it but nothing that really paves the way.

[ChopSuey]

It doesn't do "nothing" its gets stored in the MD5 doesn't it?
Here it is...
php_value session.use_only_cookies 1
php_value session.use_trans_sid 0

Add in you htaccess

[NeverBored]

Thanks. I tried it and it gave me a 500 error.

What I originally was thinking, it seems like if you knew where $session[sessionurl] is given a value you could just cancel it out. It makes sense to me but I can't find where it's handled.

[ChopSuey]

Its in the templates :) Navbar everywhere. Umm just search for that in templates you'll find it. Recommended its safe to have them on, when users cookies are off the sessions show up in the URL.

[NeverBored]

I mean find where the session variable is actually given the session id, somewhere in the php files or wherever (I've looked but cant find where). Removing the session variable in the templates is an option, but I wanted to keep the functionality for members and/or only in my forum, plus that would be a PITA to remove them all from the templates.

[ChopSuey]

Remove Session IDs.
I can give advice for PHP users, ASP and CF users should do their own research on exactly how to remove these. With PHP, if the user does not support cookies, the Session ID is automatically inserted into the URL, as a way of maintaining state between pages. Most search engines don't support cookies, which means they get a different PHPSESSID in the URL every time they visit - this leads to very ugly indexing.
There is no ideal solution to this, so I have to compromise. When sessions are a requirement for the website, I would rather lose a small number of visitors who don't have cookies, than put up with PHPSESSID in my search engine listings (and potentially lose a lot more visitors).

This will mean visitors with cookies turned off won't be able to use any features of your site that use sessions, eg logging in, or remembering form data etc.

I guess Session URL is helpful, you dont need to "remove" it.

[NeverBored]

Thanks for trying to help.

I actually just came up with exactly the solution I was looking for.

A simple plugin using global_start

$vbulletin->session->vars['sessionurl'] = '';
$vbulletin->session->vars['sessionurl_q'] = '';

It works!

[ChopSuey]

That turns it off?

[NeverBored]

Yup, it removes the session id from all links. I also added a conditional so that it only happens for guests. This way when a member logs in and isn't allowing cookies, everything works completely like normal.

[ChopSuey]

Im sure you read my post explaining what it does right? You shouldn't remove it. Oh well your choice, good luck!

[Speysider]

Well, if NeverBored comes back saying that her forum is broken, we know why. ;)