the default (and more secure) method for session propagation is using cookies. if you do not wish to use cookies then URL parameter (as in your example) is the alternative. be advised that is method will only work if the subdomain is on the same physical server (which i gather it is in your case given this thread's subject line).