I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session.
From what I have read, when sending the Session ID in a cookie to the browser SSL/TSL should be used to prevent someone from packet sniffing the Session ID and this cookie should be set to HttpOnly so that it cannot be read by JavaScript.
I personally thought checking that the client IP address from which the Session ID is being received from is constant would be a good additional measure but I have read conflicting arguments online about people saying that proxies and other things may mess with this.
My questions are:
- Is SSL/TSL and HttpOnly enough to be sure that a session cannot be hijacked?
- Is there a way to use client IP addresses as an extra layer of protection?
- Are there any more measures that can be taken to protect a session?
- Can we ever be 100% that someone cannot hijack a session?