Session hijacking
Session hijacking is the unauthorized takeover of an established session, allowing an attacker to act through the access that session provides.
Using an existing session
A web application commonly uses a cookie containing a session identifier to recognize a signed-in user on later requests. If an attacker obtains a usable session credential and the application accepts it, the attacker may act within that session without repeating the original sign-in.
Successful use depends on the application’s checks, session lifetime, and any restrictions on the credential. A copied cookie may no longer work, so finding one is not proof of successful access. Additional verification may still be required for sensitive actions.
Hijacking, password theft, and fixation
Session hijacking concerns takeover of an existing session. Password theft may instead be used to create a new authenticated session. Session fixation can lead to takeover when a victim authenticates using an attacker-known session identifier and the application keeps that identifier usable after sign-in.
OWASP recommends controls including secure cookie handling, session-ID renewal after privilege changes, and server-side session invalidation. No single cookie setting addresses every route to takeover.
To stop the access, identify which service owns the session and check that it has ended the session. Microsoft documents that application-issued sessions may require application-specific revocation; changing the identity-provider password may leave some application sessions active.