Ravi Sir's Cyber Security Cards › Revision Cards
What Is a Session – Why Hijacking Matters
What Is a Session – Why Hijacking Matters After you log in, the server makes a session and gives your browser a session ID (often in a cookie like PHPSESSID). Every next request carries that ID. The session ID is like a ticket. If someone steals it ( session hijacking ), they are logged in as you, w
Read card text
What this card says
What it is
After you log in, the server makes a session and gives your browser a session ID (often in a cookie like PHPSESSID).
Every next request carries that ID.
Why it matters for security
The session ID is like a ticket. If someone steals it (session hijacking), they are logged in as you, with no password.
Defence
Set cookies Secure and HttpOnly. Use HTTPS.
Make a new session ID at login and expire idle sessions.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Steals / guesses / fixes victim session ID | HttpOnly+Secure cookies; regenerate ID on login; short TTL |
| Replays cookie from another browser / IP | Concurrent-session alerts; bind soft signals (UA/IP)… |
| Targets apps that trust cookie alone forever | MFA for sensitive actions; logout server-side invalidate |
Learn more in the lesson: 41.1 What Is a Session – Why Hijacking Matters