Any reason to have a session id on the form?

Question

Is there any reason to put the session id on the form as a hidden form field?

---

Thanks to everyone! :)

Answer 1

This is part of one of the possible ways to prevent against attacks such as sub - forgery.

It can be used in the Synchronizer Token Template .

It can also be used in the "Double cookie sending" method mentioned at the bottom of the page linked above.

Answer 2

The only reason is to maintain session state for all users, including those with cookies disabled.