Glossary · Security

Session Hijacking

Session hijacking is an attack where someone steals or guesses a valid session ID or token and uses it to impersonate a logged-in user without their password.

Updated October 6, 2026

Session hijacking is an attack in which a third party takes over an authenticated user's session by obtaining the session identifier, usually a cookie or token. The server then treats the attacker as the legitimate user.

Why it matters

A hijacked session bypasses the password and often even MFA, because authentication already happened. Typical routes are theft through XSS, interception on unencrypted connections, malware that reads browser cookies, or predictable session IDs. Defenders reduce risk with HTTPS everywhere, cookie flags and short session lifetimes.

Example

A secure session cookie looks like this:

Set-Cookie: sid=9f2c...; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

HttpOnly hides it from scripts, Secure limits it to HTTPS and SameSite limits cross-site sending.

Common mistakes

  • Serving login pages over HTTPS but other pages over HTTP.
  • Not regenerating the session ID after login or privilege change.
  • Never expiring sessions or invalidating them on logout.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCSRF (Cross-Site Request Forgery)CSRF is an attack that tricks a logged-in user's browser into sending an unwanted request to a site where they are authenticated.Glossary · SecuritySession FixationSession fixation is an attack where an attacker sets a victim's session ID before login, then reuses it after the victim authenticates.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readError fix · Server errorsnginx "upstream sent too big header" 502 FixFix nginx 502 errors caused by upstream sent too big header while reading response header. Raise proxy_buffer_size or fastcgi_buffer_size correctly.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.