How to remove SID (session ID) from URL in Magento 2

Question

How to remove the session ID from the URL in Magento 2 (frontend). This is the SID query parameter in the URL.

For example: https://example.com/contact/?SID=sfl317buq8ru4uf4a...

Removed starting from 2.3.3 https://github.com/magento/magento2/issues/25663

Answer 1

Go to the Store > Configuration > General > Web > Session Validation Settings > Use SID on Storefront and set its value to No

Here is the good answer about the SID:

The SID is a "session ID". Magento uses this to track a user's activity within the same Magento installation. Normally, Magento powers one website and one store from one installation (database).

Magento could power multiple websites with multiple stores from one installation though. The SID allows users to stay logged in while navigating across these websites/stores.

I think if you have the function enabled, the SID is sent when accessing catalog URLs so Magento can update the session with the user's location/state for the current website/store.

If you're not running a multi-website or multi-store environment, it's safe to disable the SID on the frontend.

Answer 2

Those of you who already set Use SID on Storefront to No (as Siarhey Uchukhlebau pointed out in his answer) but still can't get rid of &sid=... in the URL, check out following links.

It is a Magento Bug, which will be fixed in version 2.3
Related ticket: https://github.com/magento/magento2/issues/9453

Fortunately, there is a Inchoo Tutorial on how to remove it via .htaccess file as workaround
http://inchoo.net/dev-talk/remove-sid-from-magento-urls/

Answer 3

Isn't ?SID automatically added by PHP if PHP is configured to not store sessions on the server or the browser doesn't accept cookies?

I believe Magento doesn't do this by default. There is a setting for it, but I'm assuming that the OP didn't change this, otherwise he would have figured this out by himself.

Answer 4

Use Frontend SID removed from store configuration settings from a Magento update. However the value may still be set to 1 in the core_config_data table.

Update your MySQL database table 'core_config_data' and set the value to '0' for path 'web/session/use_frontend_sid'. Do this for all store values.

UPDATE core_config_data SET value = '0' WHERE path = 'web/session/use_frontend_sid';

Answer 5

vendor/magento/framework/Session/SidResolver.php

Find the function and comment the line as below.

public function getUseSessionInUrl()
{
   // return $this->_useSessionInUrl;
}