Intermediate LevelAuthentication & Authorization
How do you detect and mitigate Session Hijacking attempts?
❓ Interview Prompt: Explain Session Hijacking, cookie theft, IP/User-Agent fingerprint binding, and session revocation triggers.
Session Hijacking occurs when an attacker obtains a victim's valid session ID (via XSS, packet sniffing, or malware) and uses it to impersonate the victim.
Mitigation & Detection Techniques:
1
IP & User-Agent Fingerprint Binding: Store client IP address and User-Agent hash alongside the session record. If incoming requests present a drastically different IP subnet or User-Agent, flag for re-authentication.
2
Short Session Lifetimes & Activity Timeouts: Expire inactive sessions after 15 minutes of idle time.
3
Session Invalidation on Sensitive Network Shifts: Force re-login if access shifts across geographic locations.
Code Implementation Example
typescript
function validateSessionFingerprint(req: Request, session: { ip: string; userAgent: string }) {
const currentIp = req.ip;
const currentUserAgent = req.headers['user-agent'] || '';
if (session.userAgent !== currentUserAgent) {
throw new Error('Security Alert: User-Agent mismatch detected! Session Hijacking risk.');
}
}💡Checking session User-Agent fingerprint binding.
🎯 Interview Key Takeaway
Detect session hijacking by binding sessions to client User-Agent fingerprints and IP subnet ranges.
#Session Hijacking#Fingerprinting#Security#Detection#Intermediate
Back to all Authentication & Authorization Questions→