问题
if the user has disabled cookies in the browser, do sessions work? cause i know there is a session cookie in the client when i create sessions.
回答1:
The session id can be appended to the URL, so, yes, they can.
Check out here
Edit to answer additional question
Cookies are the preferred method if you can help it. You should read the Wikipedia article to get a better understanding. From the article if you don't read it:
Transferring session identifiers as HTTP cookies is more secure
来源：https://stackoverflow.com/questions/2175138/do-sessions-work-when-cookies-are-disabled