Because the session artifact is the proof of identity after sign-in, possessing it bypasses even strong authentication. Theft paths include cross-site scripting, malware reading browser storage, adversary-in-the-middle relays, token leakage through logs or referrers, side-jacking on unencrypted channels, and fixation where the attacker plants the session identifier.
Defense works at two layers: make tokens hard to steal, and make stolen tokens useless fast. Secure cookie attributes, transport protection, token binding to client context where feasible, short lifetimes, rotation on privilege change, anomaly detection on session properties, and real revocation all narrow the window.
Key points
Theft vectorsCross-site scripting, malicious or vulnerable extensions, endpoint malware, proxied phishing, referrer and log leakage, and interception where transport protection is absent.
MitigationSecure, HttpOnly, and appropriately scoped cookies; full transport encryption; token binding and rotation; short idle and absolute lifetimes; re-authentication for sensitive actions.
Detection and responseAlert on session anomalies such as client, location, or fingerprint changes; provide working revocation; invalidate sessions on credential reset and on suspicion of theft.
Important limitationCorrectly configured cookies do not stop theft by malware or XSS on the endpoint, and long-lived sessions leave a wide abuse window even when transport is encrypted. Revocation that does not reach every issuing and consuming service is no revocation.