This question already has an answer here:
- Session Cookie Stealing Protection 2 answers
So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while browsing. So, what happened is I got the ID of the cookie and opened firefox on a different computer, I edited that phpsession cookie to the id I had on the computer where I logged in... and bam, just as expected, I was logged in.
All I could do to patch was to check that the http user agent and the first three group of numbers (xxx.xxx.xxx.123) of the IP do not change (to avoid the dynamic IP problem). I want to know though if using a permanent HTTPS connection will make the content of the php session ID un-hijackable, like someone getting into my computer, grabing the cookie content, and using it for themselves.
Extra question, I know that security through obscurity is not good but is there a way of changing the cookie name to some acronym like ps or sid?
EDIT: I do not thing this question is a duplicate because on the linked question the process to set this flags and configuration values is not mentioned.