There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. How backend service can prevent such kind of attacks even if a session cookie become known to a hacker?


1 Answer 1


In addition to the cited article, you need to manage the auth token life cycle properly. Decide if you want a cookie, be it jwt or not, to persist beyond one user session. Use expirations. Also, you need to manage authenticated users on the backend in memory or a DB, delete them as cookies expire or users logout. Create a small attack surface.

Not the answer you're looking for? Browse other questions tagged .