I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's possible when the user are coming from other network and someone from inside the same network copied (or hijacked) the cookie to another machine. After you copy a cookie from a logged session to another machine, the other machine can access the application without login because the session id is ok and the IP (when comes out to the internet) is the same.
Is there any way we can avoid it?
I was thinking having the cookie encrypted using SSL by the server sharing the key as it does for SSL connection. In this way only the right client would have the right cookie value. (Here I'm not talking about connection with SSL but encrypt the cookie. The SSL will be used encrypting the content as usual). I didn't find anything about this yet.
I would say the question is more like "How can I create a encrypted cookie based on each client and the server is the only one who can decrypt the cookie". If I just encrypt it on server, based on my encryption key, it will be the same encryption to every user and it will keep being copied.