title: is it safe or unsafe to potentially see their PHP session_id()
body: <p>On my site, I have some jquery which is making a post request from my login form to my API. Here is the jquery:</p>
  
  <pre><code>function doLogin()
  {
    var userEmail = $("#email").val();
    var userPassword = $("#password").val();
  
    $.post(
      "https://api.linkenfest.co.uk/access/login/&lt;?= $referrer ?&gt;",
      {
        email: userEmail,
        password: userPassword
      }
    ).done(function( data ){
      var status   = data.data.status;
      var referrer = data.data.referrer;
      var message  = data.data.message;
      var session  = data.data.session;
  
      alert( message );
  
      if( status == 200 ){
        window.location.replace( referrer + "?session=" + session );
      }
    }
  );
  </code></pre>
  
  <p>On returning a success, the response from my api looks like this:</p>
  
  <pre><code>{
    "status": 200,
    "data":{
            "status": 200,
            "referrer": "page.php",
            "message": "Successful login",
            "session": "o3vo1uram0k2mojmbd45pmicr2"
        }
  }
  </code></pre>
  
  <p>As you can see from my response, it includes the value obtained from php <code>session_id()</code></p>
  
  <p>I would like to find out if giving this information to the user opens up for a security vulnerability on the site.</p>
  
  <p>The session ID value is used to start the session after <code>window.location.reload</code></p>
  
  <p>Thanks.</p>