I am creating a small login system. It looks like the standard username/pwd and user can either log or register.
If they pass (authenticate), I create a session cookie that will be sent with the header every time, so that the user is not logging in every-time.
But I am pondering this scenario. The cookie is sent in the header, so it is visible for eaves droppers.
- Would they be able to send a request to the site setting a header.session.id cookie ?
In this silly case any hacker could hijack someone else's session by sniffing request headers in a net.
You can not do this in the browser URL-bar but on the console using fetch, or NodeJS request or lwp-request, python requests etc.