diff --git a/core/Session.php b/core/Session.php
index <HASH>..<HASH> 100644
--- a/core/Session.php
+++ b/core/Session.php
@@ -19,6 +19,12 @@ class Piwik_Session extends Zend_Session
 {
     public static function start($options = false)
 	{
+		// use cookies to store session id on the client side
+		@ini_set('session.use_cookies', '1');
+
+		// prevent attacks involving session ids passed in URLs
+		@ini_set('session.use_only_cookies', '1');
+
 		// don't use the default: PHPSESSID
 		$sessionName = defined('PIWIK_SESSION_NAME') ? PIWIK_SESSION_NAME : 'PIWIK_SESSID';
 		@ini_set('session.name', $sessionName);
In a default PHP configuration, these are both true/enabled.  We now set these explicitly in case the user's configuration deviates from the required values.  This also solves an installation issue where some users can't advance to step 2.

git-svn-id: <URL>