Glossary
Session Hijacking
Session hijacking is the use of a valid session identifier obtained through some means other than legitimate login — intercepted over an unencrypted connection, stolen through a scripting vulnerability, leaked in a log — to act as the session's original owner without ever needing that person's actual credentials. Because the session identifier itself is what's checked on each request, possessing it is functionally equivalent to being logged in.
Defenses concentrate on reducing how a session identifier could be obtained in the first place — encrypting it in transit, protecting it from scripts that shouldn't be able to read it, keeping its lifetime short — and on limiting the damage if one is obtained anyway, such as tying it to properties of the original request that a hijacker's own request wouldn't match.