0

I have read some articles about preventing session hijacking, and most said to use https on your site, but I don't understand how https can prevent session hijacking

how do https prevent session hijacking?

MuhammadAfif
  • 69
  • 5
  • Possible duplicate of [Is HTTPS the only defense against Session Hijacking in an open network?](https://stackoverflow.com/questions/4017344/is-https-the-only-defense-against-session-hijacking-in-an-open-network) – Zico Jul 18 '17 at 07:39

1 Answers1

0

Session hijacking can also be performed by someone sniffing your network traffic. For example, imagine that you're connected to Stackoverflow via HTTP, and there's someone reading every request you send to the server. Every time you access to a different page, you'll send your authentication cookies, along with your request to Stackoverflow, so it'll know that you're logged in, and it'll not ask you to log in again.

The problem is that since your communication is being performed as plaintext, that attacker can read your requests, he'll be able to grab your authentication cookies, and he'll be able to impersonate you.

Now, if you're using HTTPS, you're communicating over an encrypted channel. Even if an attacker is sniffing all your requests, he'll not be able to get any meaningful information, because he'll only see encrypted text. That's the reason why HTTPS is good to prevent session hijacking. Of course, there are different ways to hijack a session, and a man in the middle is just one of them, so maybe you should take a look at this: https://www.owasp.org/index.php/Session_hijacking_attack

Also, just as a side-note, "just using HTTPS" is not a panacea, it needs to be properly configured and implemented, so if you're the one who'll be performing some server-side configurations, I highly recommend you to read more about the protocol and attacks on the protocol, to avoid some common mistakes (like enabling old versions of SSL, or using broken algorithms, like RC4).

Esteban Cervantes
  • 323
  • 2
  • 11
  • Yes, they can read the info of any connection, just like you do it with the dev. tools included in chrome. For example, you can install Fiddler or Wireshark, and you'll see how it captures every request you make, and all the responses from the server (but of course, in this case they'll be intercepting your connection, so they'll be the ones seeing your requests and responses in Fiddler/Wireshark). – Esteban Cervantes Jul 19 '17 at 14:59