Summary

Session hijacking attacks aren't as easy to perform as most other Web application attacks. However, their effect can be quite damaging. Session hijacking attacks are purely an application development issue. Oversights in design or implementation of the application's session tracking mechanism result in such vulnerabilities. No operating system patch, firewall, or Web server configuration can prevent session hijacking attacks. We described session hijacking attacks and measures that should be taken during application development to prevent such attacks. Every Web developer should pay close attention to the proper design and implementation of session and state tracking. Commercial medium to high-end Web servers come with built-in session tracking mechanisms and provide an API to help developers use them in designing Web applications.