This question already has an answer here:
I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local network or wirelessly.
I did not see one case that I would like to ask about.
Can a potential hacker literally crack and enumerate a random's user cookie and throw back the cracked cookie.
we assume that the website gets a lot of traffic and has many users signed in at the same time.
In case we want to be secure from this kind of attack we may log off the user after a certain period of time or globally use an https certificate but this isn't the main theme here.