I'm learning about authentication protocols and have troubles understanding, how session hijacking can be avoided.
I learnt that one countermeasure is to use authentication protocols, which bind a unique session key to a strong mutual authentication process.
So let's say, we use some kind of mutual Challenge Response protocol with AES, and include a strong, random session key. I don't really understand how session hijacking works, but I would assume that it is somehow done via code injection. So the session key, which is stored in memory, probably isn't safe and can be taken over aswell, no?