Cybersecurity glossary
What is Session Hijacking?
Learn what session hijacking is, how attackers steal or reuse session tokens, common theft vectors like XSS and network sniffing, and how to protect authenticated sessions.
Definition
Session hijacking is an attack in which an adversary takes over a legitimate user’s authenticated session—typically by stealing, predicting, or otherwise obtaining the session token—and then impersonates that user without needing their password.
Why session hijacking is so common
Passwords are checked once; session tokens prove identity for hours or days. Steal the token and you skip authentication. That makes session hijacking a high-value follow-on to XSS, malware, and network attacks.
Defending sessions is as important as defending login forms.
Common hijacking paths
XSS cookie theft
Malicious scripts read document.cookie when HttpOnly is missing and exfiltrate the token.
Network interception
Tokens sent over HTTP or weak TLS can be captured by MITM attackers.
Client malware
Infostealers and malicious extensions extract browser cookies and bearer tokens.
Token leakage
IDs in URLs, logs, analytics, or third-party scripts expand exposure.
How hijacking typically works
Victim authenticates
The application issues a session cookie or bearer token.
Token is exposed
XSS, sniffing, malware, or leakage gives the attacker the secret.
Attacker replays the token
They present the same credential to the application.
Impersonation succeeds
The server treats the attacker as the legitimate user until logout or expiry.
Layered defenses
| Control | Why it helps |
|---|---|
| HttpOnly + Secure cookies | Blocks JS theft and requires HTTPS transport |
| SameSite cookies | Reduces cross-site sending of session cookies |
| Short lifetimes + rotation | Limits replay window after theft |
| Server-side session store | Enables revoke-on-logout and anomaly invalidation |
| Fix XSS and CSRF | Removes leading theft and abuse vectors |
| Step-up auth for sensitive actions | Stolen sessions alone cannot complete high-risk operations |
- Set Secure and HttpOnly on session cookies; choose SameSite deliberately.
- Never put session tokens in URLs or client-readable storage if avoidable.
- Prefer rotating session IDs and absolute/idle timeouts.
- Invalidate sessions server-side on logout and password change.
- Monitor for concurrent sessions from impossible locations when useful.
- Eliminate XSS with encoding, CSP, and secure frameworks.
- Require re-authentication for password, MFA, and payment changes.
- Educate users about malware and phishing that harvest sessions.
The practical takeaway
Session hijacking steals the proof of login—usually a cookie or bearer token—and replays it. Encrypt transport, harden cookies, kill XSS, and make stolen sessions short-lived and revocable.
If an attacker can read the session token, they usually are the user until you invalidate it.
Related security terms
Frequently asked questions
What is session hijacking in simple terms?
Someone steals or copies your logged-in session token and uses it to pretend to be you—without knowing your password.
How do attackers steal sessions?
Common paths include XSS cookie theft, malware, insecure HTTP sniffing, malicious browser extensions, and token leakage in logs or Referer headers.
Does HTTPS prevent session hijacking?
HTTPS prevents network sniffing of tokens in transit, but it does not stop XSS theft, malware, or token leakage through other channels.
What cookie flags help?
Secure, HttpOnly, and SameSite reduce exposure. HttpOnly stops JavaScript access; Secure requires HTTPS; SameSite limits cross-site sending.
Can short session timeouts stop hijacking?
They limit the window of abuse but do not prevent theft. Combine timeouts with rotation, binding signals, and theft-resistant token design.
Is JWT session hijacking the same?
Bearer tokens can be hijacked similarly if stolen. Stateless JWTs may be harder to revoke, so short lifetimes and careful storage matter more.
References
Explore authoritative guidance and frameworks related to session hijacking.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.