312-50 Question 257
Select 3▪ Session Hijacking CountermeasuresA financial services company discovers that users on an internal Wi-Fi network can sometimes continue authenticated web sessions by replaying another user's session cookie captured during an unsecured connection downgrade test. The security team must reduce the risk of session hijacking for its customer portal without breaking normal browser-based access. Which THREE countermeasures would be most effective?
- A
Mark session cookies with the Secure and HttpOnly attributes and enforce HTTPS across the application
- B
Regenerate the session ID immediately after user authentication and after privilege changes
- C
Bind each session strictly to the client's source IP address in all cases
- D
Set the SameSite attribute on session cookies appropriately to reduce unintended cross-site sending
- E
Increase the session timeout to 24 hours so users do not need to reauthenticate frequently
Show answer and explanation
Correct answers: A, B, D
Explanation
The most effective defenses here are to protect the session token in transit, harden how the browser handles the cookie, and reduce opportunities for token reuse. Enforcing HTTPS with Secure cookies directly addresses network interception risk, which is especially important when downgrade or mixed-transport conditions exist. HttpOnly provides additional protection against token theft through client-side script access. Regenerating session IDs after login and privilege changes is a core defense against session fixation and token reuse. SameSite is an important complementary control because it limits when browsers attach cookies to cross-site requests, reducing some forms of session abuse.
By contrast, strict source-IP binding is often brittle and can lock out legitimate users due to changing network paths, shared proxies, NAT, or mobile clients. It may be used as a supplementary risk signal, but not as a primary control. Increasing session duration makes hijacked sessions more valuable and longer-lived. Best practices align with guidance from OWASP Session Management Cheat Sheet, OWASP Transport Layer Security recommendations, and common secure cookie guidance in modern browser and web application security documentation.
- A. Correct.
Correct. Enforcing HTTPS prevents session identifiers from being exposed in cleartext over the network, which is one of the primary defenses against cookie theft and replay. The Secure attribute ensures the browser sends the cookie only over HTTPS, and HttpOnly helps reduce exposure of the cookie to client-side scripts in the event of XSS. Together, these are standard and practical countermeasures against session hijacking.
- B. Correct.
Correct. Regenerating the session ID after authentication and privilege elevation helps defend against session fixation and limits reuse of any pre-authentication identifier. This is a widely recommended practice in secure session management because it ensures a new authenticated session token is issued when the trust level changes.
- C. Incorrect.
Incorrect. While IP binding may appear to limit cookie replay, it is often unreliable in real environments because users may legitimately change IPs due to NAT, mobile roaming, VPN changes, load balancing, or proxy infrastructure. Strict IP binding can cause usability and availability issues and is not considered a primary or universally effective countermeasure for session hijacking.
- D. Correct.
Correct. SameSite does not stop network sniffing by itself, but it reduces the chance that browsers will send the session cookie in cross-site requests, which helps mitigate some session abuse scenarios such as CSRF-assisted misuse of authenticated sessions. Using SameSite=Lax or SameSite=Strict where appropriate is a recognized session protection best practice when compatible with application workflows.
- E. Incorrect.
Incorrect. Longer session lifetimes generally increase risk because a stolen token remains useful for a longer period. Shorter idle and absolute timeouts reduce the attack window for replayed session identifiers. Extending sessions to 24 hours prioritizes convenience over security and weakens session hijacking resistance.