You're right, but it does resolve the original request, which the much better cookie method doesn't.

You could improve the security of a URL-based session id by:

use CGI::Session ( '-ip_match' );
[download]

which will only allow the session if it's coming from the same IP number (downside: if your ISP changes your IP address mid-session, you'll be logged out).

Also you can improve things a little by timing out the session relatively quickly.

It's worth noting that the same security hole exists using cookies, in that somebody with a copy of your cookie could get access as you. It's just that it's a little harder for you to publish your cookie inadvertently.