Explain like I'm five · Security

What is Session Hijacking?

Session and cookie hijacking, told as a story about a thief who steals the wristband you got at the gate and walks in without a face check.

face checked — here's your wristbandthe face is checked once, at the gateTHE WRISTBANDfrom now on, just show the bandchecking faces every time makes the line too long

At the gate, the guard checks your face and gives you a wristband.One check and you're done. After that, you just show the band. Checking three times at every door would make the line too long.

peeks on the road(an unsealed letter)a bug in the pocket copies itgot a band? go on inno face checksince only the band is checked, whoever holds it is the guest

A thief steals or copies the band. The guard only looks at the band.They peek at an unsealed letter on the road (in the middle), or a bug in the pocket copies it. Whoever holds the band becomes the guest.

a thief wearing the stolen bandcome in!my band is gone!the real guest, left outsidethe band is the passsteal the band, and you walk in with no face checkbecause the guard only ever looked at the band

Session hijacking is a thief stealing your wristband.The thief needs no password and no face. With the band alone, the guard waves him in. So we seal the band, let it fade, re-check it, and cut it.

Sealed letters onlyno peeking on the road
A band that fadesstops working after a while
Odd? Check againanother town, 3 a.m.
Cut it on the way outa found band is useless
only inside a sealed lettercan't be peeked at on the roadit fades over timestolen? it soon stops workingwhere from? face check againodd place? check againanother town, three in the morningcut the band on the way outso a finder can't use ita band is convenient — so make it hard to steal and short-livedfour fixes: seal it, fade it, re-check, cut it

Send the band only in sealed letters, let it fade, and cut it when you leave.The band travels only inside a sealed letter. A faded band gets replaced. Used from a strange town, the guard asks for the face again (spotting odd habits).

this band has faded — face check, pleasethe stolen band already fadedthe guard looks at the face againthe real guest gets a fresh bandin a castle that guards its bands, a stolen band won't work for long

The stolen band has already faded. The guard checks the face again.The second face check is the gatekeeper who checks three times. Use a ring the gate recognizes instead of a band, and there is nothing to steal.

In one breath

Session hijacking = a thief steals the wristband you got at the gate and walks in with no face check. To stop it: seal the band, let it fade, re-check when something is odd, and cut it on the way out.

Session / cookie hijacking steals the session ID, cookie, or token issued after login — via man-in-the-middle, infostealers, XSS — and uses the account without a password. Defences: enforce HTTPS, Secure / HttpOnly / SameSite cookie flags, short expiry with token rotation, step-up authentication on anomalous access, and server-side invalidation on logout.

When grown-ups say it

Session
The wristband you get at the gate. Checked once, then you pass on the band alone. It is the state of being logged in.
Cookie
The pocket that holds the band. A small note the browser carries and shows every time. The band number lives here.
Session hijacking
Stealing the band. Walking in on someone else's band with no face check. No password needed.
Token theft
Copying the band. Peeked at on the road (→ in the middle) or copied by a bug in the pocket (→ the bug).
Expiry
A band that fades. Keep it short and hand out fresh ones often. Even stolen, it soon stops working.
Secure / HttpOnly / SameSite
Sealed letters only, pocket only. Never sent down an unsealed road (→ sealed letters), and no note (script) may rummage in the pocket.
Logout
Cutting the band. Not just removed from the pocket — struck from the castle's roster too, so a finder can't use it.
Step-up check
Odd? Look at the face again. A strange town, three in the morning — ask again. → the gatekeeper who checks three times, spotting odd habits
Next story
The Parrot That Mimics the King →
Want another term as a picture book? Request →