Web › Module 3 › Lesson 2
Session Hijacking
Learn how stolen session cookies and tokens let attackers become you—without your password
Visual · web_developer
After login, the server remembers you with a session ID or token. Steal that artifact and you inherit the victim’s identity until it expires.
Opening
They did not crack your password—they stole your session
Session hijacking is impersonation after authentication. The attacker grabs your session cookie, JWT, or URL token and replays it in their browser or script. You might still be logged in on your laptop while someone else is shopping as you on another device. That is why session handling is as critical as password strength.
1. How Sessions Work (Briefly)
Stateful apps often issue a random session ID stored in an HttpOnly cookie. The server maps that ID to your user record in memory or Redis. Stateless apps may put identity claims inside a signed JWT. Either way, possession of the token usually equals “you are logged in.”
2. Common Hijack Paths
XSS theft
Malicious JavaScript reads document.cookie when cookies lack HttpOnly.
Network sniffing
Session cookies sent over plain HTTP can be captured on untrusted Wi‑Fi.
Session fixation
Attacker sets a known session ID on the victim before login; server fails to rotate it after auth.
Physical access
Unlocked device + no screen lock = instant session reuse.
3. Secure Cookie Flags
Example Set-Cookie hardeningSet-Cookie: SESSIONID=abc123; Path=/; HttpOnly; Secure; SameSite=Lax # HttpOnly — JS cannot read it # Secure — sent only over HTTPS # SameSite — reduces cross-site cookie sending
Set-Cookie: SESSIONID=abc123; Path=/; HttpOnly; Secure; SameSite=Lax # HttpOnly — JS cannot read it # Secure — sent only over HTTPS # SameSite — reduces cross-site cookie sending
Rotate on privilege change
Issue a new session ID after login, password change, and MFA step-up. Invalidate old sessions server-side when users click “log out everywhere.”
Knowledge Check
Session hijacking means:
Multiple choice
Knowledge Check
True or False: HttpOnly cookies cannot be read by JavaScript in the browser.
True or False
Knowledge Check
Sending session cookies only over HTTPS requires the:
Multiple choice