Session hijacking happens when an attacker obtains or takes over an authenticated session and uses it to act as the victim. A session is the continuing interaction in which a browser visits an application and the server recognizes the signed-in user. Rather than stealing a password, the attacker targets the identity already established after login. section 9.0 section 9.5
A stolen or forged session can let an attacker log in as its owner. Session IDs and cookies are valuable targets because possession of them may be enough to continue the victim’s authenticated interaction. Attackers can capture them from insecure network traffic or access them through malicious JavaScript running in the browser. section 9.0 section 9.6 section 6.2
Intercepting a session on an insecure network
A person on a shared Wi-Fi network can listen for insecure traffic to a site and collect session information. Firesheep demonstrated this risk by showing usernames from insecure connections to social-media sites; an attacker could select a username and access that account. HTTPS-only communication prevents session cookies from being readable to a monster-in-the-middle attacker. section 9.6 section 9.6
Protect sessions in transit by sending all application traffic over HTTPS and marking session-ID cookies Secure. The Secure attribute prevents the browser from sending that cookie over an unencrypted connection. Session-management tools commonly expose this as a configuration setting, so verify that the secure option is enabled. section 9.6
Set-Cookie: session_id=4b44bd3f-5186; Secure; HttpOnly
A protected session cookie combines Secure, which limits transmission to encrypted connections, with HttpOnly, which blocks JavaScript access. section 9.6 section 9.7
Protect sessions from cross-site scripting as well. If a cookie lacks HttpOnly, JavaScript executing in the browser can access it and steal the session. Mark session cookies HttpOnly, and prevent injected scripts with escaping and content security policies. Modern frameworks usually provide an httpOnly configuration flag, often enabled by default, but it should be checked deliberately. section 9.7 section 6.2
Use these controls together because they address different paths to the same account takeover:
- Send all traffic over HTTPS and set Secure on session-ID cookies to resist interception on unencrypted networks. section 9.6
- Set HttpOnly on session cookies so browser JavaScript cannot read them. section 9.7
- Apply escaping and content security policies to reduce XSS that could steal session data. section 9.7
