# Session id and authorised characters in url

**URL:** <https://support.prodi.gy/t/session-id-and-authorised-characters-in-url/4645>\
**Category:** Uncategorized\
**Tags:** usage, database, solved\
**Created:** [September 2, 2021, 10:39am UTC](https://support.prodi.gy/t/session-id-and-authorised-characters-in-url/4645 "2021-09-02T10:39:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![EBazarov](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/ebazarov/32/1606_2.png) [@EBazarov](https://support.prodi.gy/u/EBazarov)\
**Post date:** [September 2, 2021, 10:39am UTC](https://support.prodi.gy/t/session-id-and-authorised-characters-in-url/4645/1 "2021-09-02T10:39:32Z")

</div>

Hi,

We are using Prodigy 1.10.8 with multi user sessions.

To make process simple we build an "identification" service, where we encode user identification credentials into base64 and pass it as session id.  
For example for me it will be `ZXZnZW55LmJhemFyb3ZAYmVzZWRvLmNvbQ==`, so at any time I will want to connect to prodigy I will use it as my session id.  
`?session=ZXZnZW55LmJhemFyb3ZAYmVzZWRvLmNvbQ==`  
When I check DB I see that session id was not stored as metadata, also I saw that session without `=` character stored correctly.  
I don't know if it's expected behaviour or some bug on our end.

 ![Screenshot 2021-09-02 at 13.55.45](https://us1.discourse-cdn.com/flex020/uploads/prodigy/original/2X/f/fd1155c7f1cf8cc54536388bd73d5d4074c120c6.png)  
 ![Screenshot 2021-09-02 at 13.55.57](https://us1.discourse-cdn.com/flex020/uploads/prodigy/original/2X/6/6810748d7c1334c7fd6c2a67a6966cf154cb469b.png)

---

<div class="post-metadata">

**Author:** ![EBazarov](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/ebazarov/32/1606_2.png) [@EBazarov](https://support.prodi.gy/u/EBazarov)\
**Post date:** [September 2, 2021, 12:13pm UTC](https://support.prodi.gy/t/session-id-and-authorised-characters-in-url/4645/2 "2021-09-02T12:13:51Z")

</div>

I think that I found the answer 😅

> <https://stackoverflow.com/questions/1455578/characters-allowed-in-get-parameter>

`=` symbol is not allowed in GET and should be encoded.

> There are 66 unreserved characters that doesn't need any encoding: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-\_.~

I think that just replacing this padding symbol by something like `_` will work as fast&dirty solution. Maybe add some reminder in documentation to avoid certain symbols in session name?

---

<div class="post-metadata">

**Author:** ![ines](https://sea2.discourse-cdn.com/flex020/user_avatar/support.prodi.gy/ines/32/3_2.png) [@ines](https://support.prodi.gy/u/ines)\
**Post date:** [September 5, 2021, 2:41am UTC](https://support.prodi.gy/t/session-id-and-authorised-characters-in-url/4645/3 "2021-09-05T02:41:27Z")

</div>

Thanks for the update and glad you found a solution! I guess the other alternative would be to URL-encode the special characters (which can work if you're auto-generating the URLs anyway).