How can I stop Session IDs from showing in URLs?

[sjwinslow]

I'm looking for a method I can implement on a shared server to stop the Session IDs from showing up when search engines crawl my TNG site. My site is just now being crawled by Google and I'm already seeing massive amounts of session IDs in the indexed pages on Google. I don't want the search engines to penalizing me in their ratings because they think I have duplicate pages because of the different session IDs they receive on successive scans.

I have a blog and a forum that run php code and I never see session IDs in any of the search engine pages they index for those applications. I don't understand why there are session IDs associated with TNG.

I not a programmer and I'm wondering if anyone has solved this problem.

I received an answer one time on the email list to add the following statement to the htaccess file on my site:

php_value session.use_trans_sid 0

Either I didn't implement it correctly or it is incorrect, because all it did was to stop the site from responding to any request.

Thanks for any help,

Steve

[jasendorf]

I'd have to look into the specifics, don't have the time right now, but this may be an issue with your provider's implementation of PHP. They would need to change a variable in the php.ini file.

I will look into this later today and get back.

John

[Rush]

I was look at the same thing last night. The simplest way is probably using mod_rewrite.

Going to keep tinkering with it when I get home from work tonight.

Rush

[Rush]

Been messing around with it.

The server side URL rewrite is pretty easy. I just can get the rewrite engine to work properly with TNG.

It's being a bit of a bugger...

Rush

[sjwinslow]

Rush,

Have you figured out why sometimes a Session ID is returned and sometimes its not? It may even occur differently for the same page at different times.

Steve

[Rush]

I don't ever recall getting a session ID in the url. Maybe I missed it.

I was working on the session ID and changing the all the links to something like:

http://www.bythedrop.com/getperson/Krieger/I390.php

The link change is no problem, getting TNG to use it is causing me a bit of trouble.

Rush

[sjwinslow]

I don't ever recall getting a session ID in the url. Maybe I missed it.

I was working on the session ID and changing the all the links to something like:

http://www.bythedrop.com/getperson/Krieger/I390.php

The link change is no problem, getting TNG to use it is causing me a bit of trouble.

Rush

Rush,

Click on this Google search and you will see the session ID embedded in the url that Google has indexed from my site.

http://www.google.com/search?sourceid=navc...richard+winslow

It may not be something to be concerned about but I've read many reports that the next time Google crawls my site and pulls up this link, it will be given a different Session ID. This will cause Google to view this as different page. Google may determine this is a duplicate page and reduce your ranking because of the duplication. I'm not an expert on search engines and this could be incorrect information on Googles actions but I would prefer not to take any chance of being penalized.

Steve

[Rush]

Ok, this should work adding it to your htaccess file:

<IfModule mod_php4.c>
php_value url_rewriter.tags "a=href,area=href,frame=src,input=src"
php_value session.use_only_cookies 1
php_value session.use_trans_sid 0
</IfModule>

EDIT (sorry, I forgot to put this in earlier) I added the following to my begin.php file:

ini_set('url_rewriter.tags', ''); 

That will rewrite the URL without the PHPSESSID.

Some testing I did:

I could recreate the 500 error with out much of a problem using only:

php_value session.use_trans_sid 0

in htaccess. (This is a server config issue, some servers have this disabled. Thats why it will work for some but not others).

So, this is what I did.

I added the above code to my htaccess file and begin.php. Cleared out my domain PHPSESSID cookie, disallowed all cookies, then went to a person on my site and it loaded fine - no 500 error.

So with that, a spider should not receive any PHPSESSID now.

If someone does not have cookies enable on their browser, they will not be able to log in to your site and as you have removed the option of PHPSESSID.

Let me know how it works.

Rush

[sjwinslow]

(For the benifit of others I'll post my offline response. The original message would not post on this board due to the restriction of not allowing the dot in front of htaccess in the test of the post)

Rush,

I added the code you suggested to the begin.php file (no changes were made to the htaccess file) and checked my site to ensure it was still operating properly. Not only did it appear to be operating properly but the Session IDs appear to have stopped. I'll continue to monitor it to enure they have truly stopped.

I looked at the htaccess file and there seems to be no code in it similar to that you suggested. If the Session IDs have stopped, is there any reason to place the additional code in the htaccess file?

Thanks,

Steve

P.S. What does this mean for people not using cookies?

[virtute]

(For the benifit of others I'll post my offline response. The original message would not post on this board due to the restriction of not allowing the dot in front of htaccess in the test of the post)

Rush,

I added the code you suggested to the begin.php file (no changes were made to the htaccess file) and checked my site to ensure it was still operating properly. Not only did it appear to be operating properly but the Session IDs appear to have stopped. I'll continue to monitor it to enure they have truly stopped.

I looked at the htaccess file and there seems to be no code in it similar to that you suggested. If the Session IDs have stopped, is there any reason to place the additional code in the htaccess file?

Thanks,

Steve

P.S. What does this mean for people not using cookies?

Is this htacess file suppose to be in the TNG directory or in root? I do not have either a .htacess or htaccess.txt file in my TNG directory as it is a subdirectory of my main web site.

[virtute]

ok got it fixed.