This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie back to the server, the server will take the hash and regenerate the original name of the cookie. Thus, supposedly, even if attackers stole the user's cookie "they wouldn't be able to use it".
I don't understand how this would actually render the cookie useless to the attacker. As long as the real user hasn't logged in/out of the website and caused the server to generate a new hash for the cookie name, couldn't the attacker simply send this hashed cookie name to the server and still retrieve the same information? The server would simply take the hash, regenerate the original cookie name as usual, and return another cookie/proper info.
I'm new to the area of information security, so it might be because of my novice knowledge in the field that this isn't making sense to me. But the paper also does not seem to convey the idea very clearly.
If anyone could shed light on whether/how this would actually be a feasible method in preventing XSS, it would be much appreciated!