I have a question about sessions implemented through cookies. I have just started to learn about security and I apologise if this question comes across as something elementary.
Let's say I'm using HTTPS, so all cookie data is encrypted and only the server can decrypt it with its private key. But that still isn't stopping someone from sniffing my traffic, and seeing the exact same string in the headers of every request. So someone sniffing traffic can figure out that this constant string in every request header may be a session cookie. If the attacker tries changing any characters within the request body or cookie, it will appear as junk on the server during decryption. However, even though it is encrypted, the attacker can re-submit the request and perform replay attacks, right?
Am I right to say that SSL/TLS prevents cookie tampering, but does not actually prevent stealing and/or replaying?