4 ms·
Why would an XSS attacker need to steal a temporary session ID from a cookie (which will probably expire soon), if they can just highjack the session right ther
by jondubois 10y ago
Why would an XSS attacker need to steal a temporary session ID from a cookie (which will probably expire soon), if they can just highjack the session right there on the spot from the user's own browser?
- drinchev 10y agoBecause an actor might save the session to his/her server for reuse from his own machine anytime he/she wants ( spy purposes ). Sessions usually implement `touch` functionality, which will extend the session every time a request with it has been made.
- jondubois 10y agoNot exactly 'anytime' because the session will expire as soon as the user logs out. Even if the user doesn't log out, the session will typically timeout on its own anyway (at least if the auth is implemented correctly).