5 ms·
Most eCommerce sites do not deploy SSL site-wide, but only on login and checkout actions. Look at Amazon, Wayfair, etc. Depending on how the site was coded, you
by aioprisan 13y ago
Most eCommerce sites do not deploy SSL site-wide, but only on login and checkout actions. Look at Amazon, Wayfair, etc. Depending on how the site was coded, you can mitigate session hijacking over HTTP. I'd love to see examples of Amazon session hijacking because product browse pages are simply over HTTP, I think you'll find that it's not possible to hijack those sessions.
- aeon10 13y agoI've noticed this too. Alot of ecommerce sites use HTTP for browsing. I assume this is because of speed. However I dont see why the session cannot be hijacked? If i copy all of the cookies how will the server differentiate the hijacker from the user. They both have the same cookies.
- aioprisan 13y agoCookies can be encrypted and changed with every page load, verifying sessions server-side. Session tokens can expire on every page or x-seconds and re-issued by the server.
- velis_vel 13y ago> If i copy all of the cookies how will the server differentiate the hijacker from the user. They both have the same cookies. If you set the cookies to be HTTP-only then you can't get at them from malicious JS.
- rythie 13y agoI think you just need one HTTPS only cookie (Amazon seems to have two) and just check that one (in addition to the others) at purchase time, since that one can't be stolen. However, the sign in button is served from a insecure page, so a ISP could MITM that and get your password anyway.
- aioprisan 13y agoit's easier to just hijack DNS anyways