You can prevent the most common types of session attacks by ensuring that session IDs and session cookies are protected:

  • Session IDs are unique identifiers that the web applications create and assign to users for the duration of their visit. The session ID remains the same for a period of time, but a new one should be created for each stage of the session.
  • Session cookies are files that contain the session ID. When users initially sign on to an application, a session ID and a session cookie containing that ID are created and sent to the user’s browser to provide access. The browser then sends the cookie with every request to the server, which verifies the session ID and retrieves the requested object. Session cookies are temporarily stored on the user’s device during a session and are typically destroyed when the session ends.

Session cookies are different from persistent cookies because persistent cookies exist after users close their browsers. Persistent cookies are used to recognize users and their devices, track their activity, display personalized ads, and create a better browsing experience by showing users other items that might interest them based on their browsing activities. The most common types of attacks, which are session hijacking attacks, man-in-the-middle attacks, and fixation attacks, occur when either the session ID or session cookies have been compromised.

Session hijacking

Session hijacking occurs when attackers eavesdrop on network traffic and steal or predict the target’s session ID, which enables them to impersonate the user, gain access to their sensitive information, and commit fraud and theft.

In this diagram, the attacker uses sniffer tools to obtain valid session IDs.

A diagram showing the attacker intercepting the session ID as the user is interacting with the application.

Then, attackers use these session IDs to access the application by impersonating the user.

This diagram shows the attacker using the session ID to access the application.

It is especially easy for attackers to eavesdrop on open, unencrypted wireless networks, such as the free WiFi offered at coffee shops and other businesses. Laptops or mobile devices broadcast a request to the WiFi device in the room that receives the signal, but these broadcasts are also visible to any other device in the room, including eavesdropping attackers.

Man-in-the-middle attacks

Man-in-the-middle attacks occur when attackers impersonate either the user or the application and make it appear as though normal communication is in progress. Their goal is to steal sensitive information, such as sign-on credentials, credit card numbers, and financial account details.

First, they find a way to impersonate the original connection, then they communicate with the user, and finally, they access user accounts. These types of attacks can be compared to your mailman opening your bank statement, obtaining your account information, resealing the envelope, and delivering it to your door.

This diagram shows the attacker impersonating the original connection.

Fixation attacks

Fixation attacks occur when attackers steal valid session IDs that have not yet been authenticated. Attackers send users a link that contains the session ID and tricks them into clicking on it. When they authenticate with what they think is the application, the attacker uses the same session ID to access user accounts.

This diagram shows the attacker sending the user a link. The user clicks on the link to access what they think is the application. The attacker uses that session to access the application.