How does the Session-Library work if cookies are rejected by the browser?

It seems like you understand sessions enough to get you in trouble. Having the session ID as a query string param is a security risk. Instead, test for cookies and let the site visitor know that they must enable cookies for your site to work properly.

And by the way, if somebody doesn't have cookies enabled, most of the internet is probably broken for them anyways, so they're used to it.

Expert Website Development - Temecula, CA
Community Auth For CodeIgniter 3