Are there any security practices/techniques/considerations when, for example during (long/continuous) polling or normal requests between clients and server, session ID is sent/passed to the server as a query string parameter instead of a value stored in a cookie?
I can think of session hijacking or sniffing when someone would stole this session ID from query string and use it to impersonate himself, but I think the same thing can also happen to cookie value (I guess this can be prevented only by using https).