Navigating with Sessions when Cookies are Disabled

[gunnzo]

Hello everyone, I'm hoping somebody here can help me out with a few quick questions.

1. I am under the impression that zen cart works with cookies disabled by appending the zenid to the end of the url when cookies are disabled. Is this the way it is supposed to work, or is it insecure to allow this?

2. In the main navigation (tpl_header.php), both the logo and the homepage do not use the zen_href_link function to build their urls, and thus don't include the zenid, breaking the session for those with cookies disabled, is this intentional, or is there a drawback to including the zenid if cookies are disabled (eg using the zen_href_link function to build the links rather than HTTP_SERVER . DIR_WS_CATALOG)?

3. There are many other instances of mods, customizations, etc that do not use the zen_href_link function, do I need to find all of them and change them to use this function in order to enable support for those with cookies disabled, or again, is this insecure?

Thanks for your time!

[DrByte]

You're asking a bunch of questions based on an assumption that you want to disable cookies. WHY?
In years past cookies were frowned upon. Nowadays they're commonplace. What's your rationale for wanting to prevent them?

[gunnzo]

Thanks for responding. I don't want to prevent them, I was simply looking into finishing up enabling support for those with cookies disabled (not even sure if anyone would have cookies disabled, but we were having issues with session time outs, and add to cart redirecting to 404, sessions ending prematurely, etc similair to https://www.zen-cart.com/showthread....disabled/page2 which is what led me to this) since it seems like it is half-way implemented already, but should I instead just force everyone to use cookies? Then I don't see why force cookie use isn't set to true as default for zencart since it doesn't seem to work with cookies disabled anyways...?

Basically I'm just wondering if the support for non-cookie users is worth revisiting or just old code that's now irrelevant.

[gunnzo]

And on another related note in that thread you mentioned session.use_only_cookies needs to be 0, is that still the case even though it is now defaulted to 1 in php?