I'm no expert on security so if anyone has input on the following situation I'd appreciate it.
I need to get a visitor's session ID into a javascript variable. I can do it in two ways:
<script type="text/javascript">
var sessionID = "<?php echo $sessionID; ?>";
</script>
OR, using jquery and ajax:
<script type="text/javascript">
$.get( "/showSessionID.php", function(data){
window["sessionID"] = data;
});
</script>
The second method hides the session id from the source code, however it generates a 2nd page request that's almost unnecessary. So I'd prefer the first method as long as it doesn't pose any security risks.
The one minor problem I'm thinking is that search engines will cache their own session id in the source code, which will be viewable in cached pages, but the session id of a search engine spider isn't a big deal
Any thoughts, suggestions, alternatives?
