I am taking a web security class and was told by the instructor that most of the websites today use https for authentication and then use a cookie (authentication token) in plain text to keep track of the user.
I wanted to confirm this. For example, when I use Amazon.com, if I logged in before, Amazon shows something relevant to my history. For this they must be using a cookie. But when I click on Account, a https page is opened. If I am looking at my account details, why would Amazon choose to send a cookie (acting as an authentication token) in plain text ? If I can listen over the wire, can't I just steal the cookie and hijack someone's session ?
My hypothesis is that websites like Amazon have multiple cookies, some are for pages that don't need https (like the home page), but still want to keep track of user history; others are for tracking if user authenticated previously (so user doesn't need to type password again), and this type of cookie must always be sent over https.
Can anyone confirm my hypothesis ? (I believe my instructor might not be entirely correct)