when cookies is not enable in browser then how to store session in php

Question

Today, I had a PHP interview. The interviewer asked to me:

It is possible to store session value if cookies in browser is not enable?

I answered "No". Because when we set session, sessionid is store in cookie in user's browser.

I am confuse, it is right answer or not?

Because, interviewer said, there is no another way of storing session when cookie is disable. Please provide me a way with example , if is it possible.

Thanks for valuable comments.

Answer 1

Pass the session ID around in the URL. So links on the page you generate all go to .../page.php?sess=<id>&foo=bar

Answer 2

There are several ways to imitate a cookie, if cookies are turned off.

You can 'fingerprint' the client by collecting as much knowledge as possible (IP, UserAgent etc. etc.) make a hash, and use that to save/retrieve your session ... not foolproof and prone to collisions ... but better than nothing.

This technique can be made more robust by adding information gathered by JavaScript ... which in turn makes your loading-procedure rather twisted. But it is possible.

You can also use local-storage at client and then synchronise win ajax.

None of this is easy ... but possible.