← Back to glossary
🧤

Session Hijacking

Threats

Phishing Man‑in‑the‑Middle (MITM) Attack XSS (Cross‑Site Scripting) Session Management

Unauthorized reuse of a valid session identifier.

Definition

Session hijacking involves capturing or obtaining session identifiers (cookies/tokens) via XSS, network interception, malware, or phishing, then replaying them to impersonate the user.

In plain English Unauthorized reuse of a valid session identifier.

Why this matters

Why it matters: It enables account access without needing the user’s credentials once a session token is obtained.

Example

Example: Token theft via XSS followed by replay from a different device.