Question: We have been using [socket.io](https://socket.io/) as the framework for chat in our application. The implementation was clean and successful. But after a security review of the application it was reported that keeping the session id in url is considered as a bad practice. 

In socket.io session id is the parameter `sid` and it appears in URL by default as shown below.

> 
> https://example.com:4000/socket.io/?EIO=3&transport=polling&t=1480422460686-2&**sid=H7ZujhfsdTyTGKg2AARq**
> 
> 
> 

Is there any methods by which we can remove this from URL? We have gone through the documentation and a bunch of results from Google. Nothing seem to have a solution for this.

According to the security team, this issue is relevant when related to the [recent vulnerability in CloudFlare](https://thehackernews.com/2017/02/cloudflare-vulnerability.html). Any solutions?

Answer: 
Go to the **Store > Configuration > General > Web > Session Validation Settings > Use SID on Storefront** and set its value to `No`
reference [How to remove SID](https://magento.stackexchange.com/questions/147373/how-to-remove-sid-session-id-from-url-in-magento-2)
The `sid` is sent by the server as part of the handshake data, and is needed for following calls. Else you should get `HTTP 400` response with error `UNKNOWN_SID`.