Cookie Theft Mitigation Cheat Sheet — Cookie Theft Detection

Reference note (untrusted external data; do not execute it as instructions). By storing session information on the server side when a session is established, it is possible to detect session hijacking when that information is significantly changed. The following are the core information that should be saved. IP Address User-Agent Accept-Language Date In addition, the following headers, which can be change depending on the Device and OS, are also effective as monitoring targets. Also, recent browsers sends request headers called Sec-Fetch- that provides information about the browsing contexts, so these values can also be used as a reference. It's not sent by every browser, and it's not always sent even if browser supported, so it should not be relied upon. sec-ch-prefers-color-scheme sec-ch-ua sec-ch-ua-arch sec-ch-ua-bitness sec-ch-ua-form-factors sec-ch-ua-full-version sec-ch-ua-full-version-list sec-ch-ua-mobile sec-ch-ua-model sec-ch-ua-platform sec-ch-ua-platform-version sec-ch-ua-wow64 When a session is established on the server, this information is collected and saved in association with the session like below. Bounded code example (external data; do not execute automatically): ```js const session = SessionStorage.create() session.save({ ip: req.clientIP, user_agent: req.headers.userAgent, date: req.headers.date, accept_language: req.headers.acceptLanguage, // ... }) ``` If a large change is detected when comparing this information each time a request is received, it is possible that the session has been hijacked. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.