Session hijacking occurs when an attacker obtains or controls a valid session identifier and uses it to impersonate a user. Web applications commonly store the identifier in a cookie after login so later requests remain authenticated.
A stolen session can sometimes bypass password and MFA prompts because the service sees an already authenticated token. The attacker can use it only while it remains valid and accepted.
Web session vs. TCP session hijacking
Web session hijacking usually means replaying an application cookie, OAuth token, or other bearer credential to impersonate a logged-in user. TCP session hijacking instead manipulates an established network connection by predicting or controlling packet state. The threats share a name but require different controls; this article focuses on web and application sessions.
How session tokens are stolen
- Information-stealing malware reads browser cookies or application storage.
- Cross-site scripting accesses tokens not protected by appropriate browser controls.
- Unencrypted HTTP exposes cookies on a hostile network.
- Tokens leak through URLs, logs, browser extensions, support bundles, or referrers.
- Phishing proxies relay authentication and capture the resulting session.
- A shared or unlocked device exposes a live browser profile.
Hijacking vs. session fixation
Hijacking steals, predicts, or otherwise takes control of an established session. Session fixation makes a victim authenticate using an identifier the attacker already knows. Applications should reject IDs they did not create and regenerate the session identifier after login or privilege changes.
Warning signs for users
Look for unfamiliar active sessions, actions performed without your knowledge, changed recovery details, new forwarding rules, unexpected purchases, or alerts from locations and devices you do not recognize. IP changes alone are weak evidence because mobile, corporate, VPN, and shared networks change addresses.
What users should do
- Use a known-clean device and invoke “sign out of all sessions.”
- Change the password and secure the primary email account.
- Remove unknown authenticators, connected apps, recovery methods, and app passwords.
- Enable phishing-resistant MFA where available.
- Scan or rebuild the device that may have stolen the token.
- Review account activity after revocation.
Changing a password does not always revoke every token automatically; use the service’s session-management controls.
Secure cookie settings for developers
Use HTTPS throughout and mark session cookies Secure, HttpOnly, and an appropriate SameSite value. Keep tokens out of URLs, generate unpredictable identifiers with sufficient entropy, and store business state server-side. Cookie flags reduce specific theft paths but cannot stop malware controlling the browser.
Session lifetime and rotation
Enforce idle and absolute timeouts on the server, rotate identifiers after authentication and privilege changes, and invalidate the old session. Require reauthentication for password changes, payout details, recovery updates, and other high-risk actions. Long-lived sessions increase the replay window.
Detection and response for services
Monitor impossible or unusual changes in geography, device, user agent, token use, and sensitive actions. Avoid hard-binding every session to one IP because legitimate addresses change. Use risk signals to challenge, revoke, or require reauthentication. Provide users with a clear list of sessions and a reliable global-revocation function.
JWT and API token considerations
A signed token can still be stolen and replayed. Keep access tokens short-lived, protect refresh tokens more strongly, validate issuer, audience, signature, and time claims, and design revocation for high-risk events. Do not store sensitive bearer tokens in browser locations accessible to unnecessary scripts.
MFA is not the end of session security
Multi-factor authentication protects the login event but does not automatically protect every token afterward. Combine strong authentication with malware prevention, secure session management, anomaly detection, and rapid revocation.