What is Session Hijacking?
Session and cookie hijacking, told as a story about a thief who steals the wristband you got at the gate and walks in without a face check.
At the gate, the guard checks your face and gives you a wristband.One check and you're done. After that, you just show the band. Checking three times at every door would make the line too long.
A thief steals or copies the band. The guard only looks at the band.They peek at an unsealed letter on the road (in the middle), or a bug in the pocket copies it. Whoever holds the band becomes the guest.
Session hijacking is a thief stealing your wristband.The thief needs no password and no face. With the band alone, the guard waves him in. So we seal the band, let it fade, re-check it, and cut it.
Send the band only in sealed letters, let it fade, and cut it when you leave.The band travels only inside a sealed letter. A faded band gets replaced. Used from a strange town, the guard asks for the face again (spotting odd habits).
The stolen band has already faded. The guard checks the face again.The second face check is the gatekeeper who checks three times. Use a ring the gate recognizes instead of a band, and there is nothing to steal.
Session hijacking = a thief steals the wristband you got at the gate and walks in with no face check. To stop it: seal the band, let it fade, re-check when something is odd, and cut it on the way out.
Session / cookie hijacking steals the session ID, cookie, or token issued after login — via man-in-the-middle, infostealers, XSS — and uses the account without a password. Defences: enforce HTTPS, Secure / HttpOnly / SameSite cookie flags, short expiry with token rotation, step-up authentication on anomalous access, and server-side invalidation on logout.
When grown-ups say it
- Session
- The wristband you get at the gate. Checked once, then you pass on the band alone. It is the state of being logged in.
- Cookie
- The pocket that holds the band. A small note the browser carries and shows every time. The band number lives here.
- Session hijacking
- Stealing the band. Walking in on someone else's band with no face check. No password needed.
- Token theft
- Copying the band. Peeked at on the road (→ in the middle) or copied by a bug in the pocket (→ the bug).
- Expiry
- A band that fades. Keep it short and hand out fresh ones often. Even stolen, it soon stops working.
- Secure / HttpOnly / SameSite
- Sealed letters only, pocket only. Never sent down an unsealed road (→ sealed letters), and no note (script) may rummage in the pocket.
- Logout
- Cutting the band. Not just removed from the pocket — struck from the castle's roster too, so a finder can't use it.
- Step-up check
- Odd? Look at the face again. A strange town, three in the morning — ask again. → the gatekeeper who checks three times, spotting odd habits