问题
Most Web Applications use cookies to manage the session for a user and allow you to stay logged in even if the browser was closed.
Lets pretend we did everything in the book to make sure the cookie itself is save.
- encrypt the content
- set http only
- set secure
- ssl is used for the connection
- we check for tampering with the content of the cookie
Is it possible to prevent someone with physical access to the machine to copy the cookie and reuse it on another machine and thus stealing the session?
回答1:
It doesn't make sense to "protect" against this. If this kind of copying happens, then either:
- The end user did it on purpose because they wanted to change computers. This is, of course, not something you should care about or be concerned about.
- An attacker has already compromised the user's browser and gotten access to the cookies stored inside. By definition this cookie is a secret that proves that the identity of the HTTP client. If the attacker already has access to it, they can already use it in any number of ways of their choosing that you won't be able to prevent or distinguish from the real user accessing the server legitimately.
回答2:
This risk is inherent in using cookies to authenticate sessions: the cookie is a bearer token, anyone who can present the cookie is authenticated.
This is why you see further protections such as:
- automatic log out after a certain amount of time, or period of inactivity;
- device fingerprinting;
- requiring re-authentication for critical actions (e.g. making a bank transfer or changing your password).
来源：https://stackoverflow.com/questions/17030081/how-do-i-prevent-session-hijacking-by-simply-copy-a-cookie-from-machine-to-anoth