Session Hijacking

ELI5 — The Vibe Check

Session hijacking is when an attacker steals your session cookie or token and impersonates you. Like stealing someone's festival wristband and using it to get into shows in their place. The real user gets locked out or has no idea. Secure cookies, HTTPS, and short session lifetimes limit the damage.

Real Talk

Session hijacking (session theft) occurs when an attacker obtains a valid session identifier to impersonate an authenticated user. Methods include XSS (steal cookies via JavaScript), network interception (without HTTPS), and predictable session IDs. Mitigations: HttpOnly and Secure cookie flags, short session timeouts, and HTTPS everywhere.

Show Me The Code

// Setting secure session cookies
res.cookie('sessionId', sessionToken, {
  httpOnly: true,  // JavaScript cannot read this cookie
  secure: true,    // Only sent over HTTPS
  sameSite: 'strict', // Blocks CSRF
  maxAge: 15 * 60 * 1000, // 15 minutes
});

When You'll Hear This

"XSS vulnerabilities enable session hijacking via document.cookie." / "Set HttpOnly on session cookies to prevent JavaScript access."