That is literally what session hijacking is. A uses the session created for B, various ways. Do not store sessions in signed cookies, because those can be stol

That is literally what session hijacking is. A uses the session created for B, various ways. Do not store sessions in signed cookies, because those can be stolen, and they bloat your requests and responses shipping all the data up and down each time. Store sessions in a database, tie them to an IP, and time them out. Transmit only an opaque ID. Ideally, re-create a different ID with each new request. If you are using a web framework, it should have tried and tested mechanisms to do all this for you. This is the kind of thing you lose cooking your own CGI.