I am working at a SSO project right now with CAS. I am using an RESTful API for communication with desktop-applications. The value of the Ticket Granting Cookie is encrypted. At first I didn't think much about it, but now I realized that I don't really get why that is the case. Since I use HTTPS between the different nodes, the connection is secure. The cookie will be saved in the cookie database of the browser.
As far as I see it, there is a possibility of session hijacking in such cases. But since I use HTTPS I don't get how that should even be possible. Even if it is encrypted, why not just take the encrypted cookie and hijack it. As it seem to me the owner of the ticket also does not have to, and cannot decrypt the cookie value. So at the end of the day he just saves an encrypted cookie and sends it back, a hijacker could do the same if he can break through HTTPS.
Am I missing something?