Session Cookie.

What Is a Session Cookie?

A session cookie is a small piece of data that a website stores in your browser so it can recognize you after you sign in. It usually holds a session identifier, also called a session ID or session token. OWASP says a session token is normally a string of variable width. It can be carried in the URL or in the header of the HTTP request as a cookie.

How Does a Session Cookie Work?

When you sign in, the website starts a session and gives your browser an identifier. Your browser sends it back with each later request, so the site knows the requests belong to the same session. The OWASP Session Management Cheat Sheet calls cookies the most extensively used mechanism for exchanging session IDs. It says cookies offer security features that other methods, such as URL parameters, do not. It also says the session ID value must be meaningless, so that it does not disclose information.

How Does Cookie Theft Lead to Hijacking?

Session hijacking means using a stolen session token to get in without the password, as OWASP describes it. See session hijacking. When the token sits in a cookie, stealing it is often called cookie theft.

How Do Attackers Get Hold of a Session Token?

OWASP lists several ways a session can be compromised:

• A predictable session token that can be guessed.
• Session sniffing, which means capturing network traffic to read the token.
• Client-side attacks, such as cross-site scripting (XSS), malicious JavaScript code and Trojans.
• Man-in-the-middle attacks, where the attacker sits between the user and the site.
• Man-in-the-browser attacks.

OWASP gives two examples. In one, attackers use a sniffer to capture a valid session ID and then use that token to gain unauthorized access. In the other, an attacker uses an XSS attack to steal the session token.

What Happens When Someone Replays Your Cookie?

A person signs in to a web application. An attacker obtains the session cookie that the browser holds. The attacker presents that cookie to the site, and the site treats the request as coming from the signed-in person.

Which ATT&CK Techniques Cover Cookie Theft and Reuse?

MITRE ATT&CK splits the problem into stealing a cookie and using it. The table below lists four techniques from MITRE. Stolen cookies can get around MFA without the prompt flooding of MFA fatigue. They are also a form of valid account misuse.

How Can Websites Protect Session Cookies?

The OWASP Session Management Cheat Sheet gives these points:

• Session identifiers must have at least 64 bits of entropy, to prevent brute-force session guessing.
• The Secure attribute tells browsers to send the cookie only over an encrypted HTTPS connection.
• The HttpOnly attribute tells browsers not to let scripts access the cookie.
• Session cookies must explicitly set SameSite=Strict (preferred) or SameSite=Lax.
• The session ID must be renewed or regenerated after any privilege level change.
• Applications should use idle and absolute timeouts, and provide a visible and easily accessible logout button.

Is a Session Cookie the Same as a Session ID?

Not quite. The session ID is the value that identifies the session. The cookie is one way to carry that value between browser and site. OWASP notes the token can also appear in the URL.

A session cookie can be intercepted by an attacker positioned between the user and the site, as MITRE describes for a man in the middle attack.

Some applications also pass sessions in other tokens. Apache OFBiz externalLoginKey flaw CVE-2026-82907 shows a login key that never expires and works without any cookie.