What is Session Hijacking?

Session hijacking is unauthorized use of an existing user session. Instead of knowing the password, the attacker presents a valid session cookie or access token, making requests appear to come from the victim. Administrator and support sessions are particularly valuable.

How are sessions obtained?

Example secure session cookie

Set-Cookie: session=RANDOM_OPAQUE_VALUE;
  Path=/;
  Secure;
  HttpOnly;
  SameSite=Lax

Secure restricts transport to HTTPS, HttpOnly blocks direct JavaScript access and SameSite limits cross-site requests. None makes a stolen token useless; the server must enforce lifetime, revocation and trust transitions.

Limiting the impact

• - Regenerate IDs after login, MFA and privilege changes.
• - Use short idle and reasonable absolute timeouts.
• - Require reauthentication for password, payment and administrative actions.
• - Revoke all relevant sessions on logout, password change and incident response.
• - Detect new devices, impossible travel and parallel use without relying on brittle IP pinning.
• - Never record token values in analytics, referrers, URLs or normal logs.

Detection and response

Signals include abrupt device or region changes, incompatible concurrent use, new sensitive actions and reuse of revoked tokens. A response can suspend the session, notify the user and require authentication. Combine signals because VPN, mobile and travel changes can look similar.

Useful open-source tools

OWASP ZAP shows cookie attributes, token flows and logout behavior. mitmproxySemgrep can enforce project-specific cookie and logging rules. Use only owned test accounts and explicit authorization.