Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites.
In each request the server sends a Set-Cookie that sets a new session cookie that is used by the browser in the next request... This mechanism is supposed to reduce the risk of cookie theft. I suppose that it does not protect the cookie theft completely because if you steal the cookie before the user uses it, you can use it one time and get the new set-cookie...but it is more difficult for an attacker to use it.
Does it have sense? It is a valid mechanism to avoid cookie theft?