I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session.
I personally thought checking that the client IP address from which the Session ID is being received from is constant would be a good additional measure but I have read conflicting arguments online about people saying that proxies and other things may mess with this.
My questions are:
- Is SSL/TSL and HttpOnly enough to be sure that a session cannot be hijacked?
- Is there a way to use client IP addresses as an extra layer of protection?
- Are there any more measures that can be taken to protect a session?
- Can we ever be 100% that someone cannot hijack a session?