Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause damage to any of my online accounts?

For my situation, I am limiting all of the damage I can by running a VPN and trying to access all websites using https://. I know a lot of users do not do this, so there might be even more risk for them to stay logged in, but also for me, there still may be risk.


Yes, there is a risk - Cross-Site Request Forgeries. This attack ignores any encryption you apply to the channel between yourself and the web site by getting your browser (which holds the authentication cookie(s)) to submit a request to the vulnerable web site.

Though, in your favor, you would have to view some poisoned content to trigger the attack. The poisoned content could take the form of a link in a phishing email or a website serving an image tag with a malicious src.

It isn't exactly session hijacking (the attacker does not get to see the response(s) from the vulnerable web site), but it's close.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.